CVE-2022-50498

A missing synchronization flaw was found in the Linux kernel's Atheros alx Ethernet driver in the suspend/resume path. A local user can trigger this issue during system suspend/resume operations when the driver fails to acquire the rtnl_lock mutex before calling internal network device open functions. This causes an RTNL assertion failure, resulting in a kernel warning or potential race conditions during device state transitions.

The alx driver performs device close and reopen operations during suspend/resume without holding the required rtnl_lock mutex. The network core expects this lock to be held when changing device queue configuration, and trips an assertion when it detects the lock is missing. While the driver implements its own internal locking and doesn't actually change queue counts, the missing rtnl_lock violates kernel locking conventions and could potentially lead to races if the network core state changes during suspend/resume.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the alx module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.