# CVE-2022-49841: serial: imx: Add missing .thaw_noirq hook

Status: published. Published: 2025-05-01. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

serial: imx: Add missing .thaw_noirq hook

The following warning is seen with non-console UART instance when
system hibernates.

[   37.371969] ------------[ cut here ]------------
[   37.376599] uart3_root_clk already disabled
[   37.380810] WARNING: CPU: 0 PID: 296 at drivers/clk/clk.c:952 clk_core_disable+0xa4/0xb0
...
[   37.506986] Call trace:
[   37.509432]  clk_core_disable+0xa4/0xb0
[   37.513270]  clk_disable+0x34/0x50
[   37.516672]  imx_uart_thaw+0x38/0x5c
[   37.520250]  platform_pm_thaw+0x30/0x6c
[   37.524089]  dpm_run_callback.constprop.0+0x3c/0xd4
[   37.528972]  device_resume+0x7c/0x160
[   37.532633]  dpm_resume+0xe8/0x230
[   37.536036]  hibernation_snapshot+0x288/0x430
[   37.540397]  hibernate+0x10c/0x2e0
[   37.543798]  state_store+0xc4/0xd0
[   37.547203]  kobj_attr_store+0x1c/0x30
[   37.550953]  sysfs_kf_write+0x48/0x60
[   37.554619]  kernfs_fop_write_iter+0x118/0x1ac
[   37.559063]  new_sync_write+0xe8/0x184
[   37.562812]  vfs_write+0x230/0x290
[   37.566214]  ksys_write+0x68/0xf4
[   37.569529]  __arm64_sys_write+0x20/0x2c
[   37.573452]  invoke_syscall.constprop.0+0x50/0xf0
[   37.578156]  do_el0_svc+0x11c/0x150
[   37.581648]  el0_svc+0x30/0x140
[   37.584792]  el0t_64_sync_handler+0xe8/0xf0
[   37.588976]  el0t_64_sync+0x1a0/0x1a4
[   37.592639] ---[ end trace 56e22eec54676d75 ]---

On hibernating, pm core calls into related hooks in sequence like:

    .freeze
    .freeze_noirq
    .thaw_noirq
    .thaw

With .thaw_noirq hook being absent, the clock will be disabled in a
unbalanced call which results the warning above.

    imx_uart_freeze()
        clk_prepare_enable()
    imx_uart_suspend_noirq()
        clk_disable()
    imx_uart_thaw
        clk_disable_unprepare()

Adding the missing .thaw_noirq hook as imx_uart_resume_noirq() will have
the call sequence corrected as below and thus fix the warning.

    imx_uart_freeze()
        clk_prepare_enable()
    imx_uart_suspend_noirq()
        clk_disable()
    imx_uart_resume_noirq()
        clk_enable()
    imx_uart_thaw
        clk_disable_unprepare()

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 09df0b3464e528c6a4ca2c48d9ff6d2fd7cbd775; < e401312ca6e180ee1bd65f6a766e99dd40aa95e7 (affected, git); ≥ 09df0b3464e528c6a4ca2c48d9ff6d2fd7cbd775; < 476b09e07bd519ec7ba5941a6a6f9a02256dbb21 (affected, git); ≥ 09df0b3464e528c6a4ca2c48d9ff6d2fd7cbd775; < 0a3160f4ffc70ee4bfa1521f698dace06e6091fd (affected, git); ≥ 09df0b3464e528c6a4ca2c48d9ff6d2fd7cbd775; < ae22294e213a402a70fa1731538367d1b758ffe7 (affected, git); ≥ 09df0b3464e528c6a4ca2c48d9ff6d2fd7cbd775; < e3f9d87d6f0732827c443bd1474df21c2fad704b (affected, git); ≥ 09df0b3464e528c6a4ca2c48d9ff6d2fd7cbd775; < 4561d8008a467cb05ac632a215391d6b787f40aa (affected, git). Source: CNA: Linux
- Linux / Linux: 4.16 (affected); ≥ 0; < 4.16 (unaffected, semver); ≥ 4.19.267; ≤ 4.19.* (unaffected, semver); ≥ 5.4.225; ≤ 5.4.* (unaffected, semver); ≥ 5.10.156; ≤ 5.10.* (unaffected, semver); ≥ 5.15.80; ≤ 5.15.* (unaffected, semver); ≥ 6.0.10; ≤ 6.0.* (unaffected, semver); ≥ 6.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.20% as of 2026-11-05; percentile 10.28%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/e401312ca6e180ee1bd65f6a766e99dd40aa95e7 (CNA: Linux)

- https://git.kernel.org/stable/c/476b09e07bd519ec7ba5941a6a6f9a02256dbb21 (CNA: Linux)

- https://git.kernel.org/stable/c/0a3160f4ffc70ee4bfa1521f698dace06e6091fd (CNA: Linux)

- https://git.kernel.org/stable/c/ae22294e213a402a70fa1731538367d1b758ffe7 (CNA: Linux)

- https://git.kernel.org/stable/c/e3f9d87d6f0732827c443bd1474df21c2fad704b (CNA: Linux)

- https://git.kernel.org/stable/c/4561d8008a467cb05ac632a215391d6b787f40aa (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2022-49841; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2022-49841; retrieved 2026-11-05; source updated Not reported

Revision: 92f3de1d60cc9423ce0351c0651f4fc1497eae3677776e99a4afaa1105d14026

Canonical: https://y2.dev/cve/CVE-2022-49841

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.