CVE-2022-50258
published 2025-09-15CVE-2022-50258: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This patch…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.15%
5.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
This patch fixes a stack-out-of-bounds read in brcmfmac that occurs
when 'buf' that is not null-terminated is passed as an argument of
strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware
version string by memcpy() in brcmf_fil_iovar_data_get().
The patch ensures buf is null-terminated.
Found by a modified version of syzkaller.
[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3
[ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[ 47.601565][ T1897] ==================================================================
[ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0
[ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897
[ 47.604336][ T1897]
[ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131
[ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event
[ 47.607453][ T1897] Call Trace:
[ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1
[ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334
[ 47.609009][ T1897] ? strsep+0x1b2/0x1f0
[ 47.609434][ T1897] ? strsep+0x1b2/0x1f0
[ 47.609863][ T1897] kasan_report.cold+0x83/0xdf
[ 47.610366][ T1897] ? strsep+0x1b2/0x1f0
[ 47.610882][ T1897] strsep+0x1b2/0x1f0
[ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0
[ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40
[ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100
[ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0
[ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0
[ 47.614704][ T189
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.20-1 (bookworm) | linux 6.1.20-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 0af29bf7c1ddf5f3c35577409de46ede5e8d7845 < 89243a7b0ea19606ba1c2873c9d569026ccb344f | 89243a7b0ea19606ba1c2873c9d569026ccb344f |
| linux | linux | >= 0af29bf7c1ddf5f3c35577409de46ede5e8d7845 < d481fd6064bf215d7c5068e15aa390c3b16c9cd0 | d481fd6064bf215d7c5068e15aa390c3b16c9cd0 |
| linux | linux | >= 0af29bf7c1ddf5f3c35577409de46ede5e8d7845 < 17dbe90e13f52848c460d253f15b765038ec6dc0 | 17dbe90e13f52848c460d253f15b765038ec6dc0 |
| linux | linux | >= 0af29bf7c1ddf5f3c35577409de46ede5e8d7845 < d6ef66194bb4a6c18f5b9649bf62597909b040e4 | d6ef66194bb4a6c18f5b9649bf62597909b040e4 |
| linux | linux | >= 0af29bf7c1ddf5f3c35577409de46ede5e8d7845 < 3a3a5e3f94068cd562d62a57da6983c8cd07d53c | 3a3a5e3f94068cd562d62a57da6983c8cd07d53c |
| linux | linux | >= 0af29bf7c1ddf5f3c35577409de46ede5e8d7845 < 881f50d76c3892262730ddf5c894eb00310e736c | 881f50d76c3892262730ddf5c894eb00310e736c |
| linux | linux | >= 0af29bf7c1ddf5f3c35577409de46ede5e8d7845 < ba166e0ebdde3dfa833f0a3edaf2b2934d4a87f7 | ba166e0ebdde3dfa833f0a3edaf2b2934d4a87f7 |
| linux | linux | >= 0af29bf7c1ddf5f3c35577409de46ede5e8d7845 < 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 | 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 |
| linux | linux_kernel | < 4.14.308 | 4.14.308 |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 4.15 < 4.19.276 | 4.19.276 |
| linux | linux_kernel | >= 4.20 < 5.4.235 | 5.4.235 |
| linux | linux_kernel | >= 5.11 < 5.15.99 | 5.15.99 |
| linux | linux_kernel | >= 5.16 < 6.1.16 | 6.1.16 |
| linux | linux_kernel | >= 5.5 < 5.10.173 | 5.10.173 |
| linux | linux_kernel | >= 6.2 < 6.2.3 | 6.2.3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vcqq-2g47-gfp7: In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
Thi
ghsa_unreviewed·2025-09-15
CVE-2022-50258 [HIGH] CWE-787 GHSA-vcqq-2g47-gfp7: In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
Thi
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
This patch fixes a stack-out-of-bounds read in brcmfmac that occurs
when 'buf' that is not null-terminated is passed as an argument of
strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware
version string by memcpy() in brcmf_fil_iovar_data_get().
The patch ensures buf is null-terminated.
Found by a modified version of syzkaller.
[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3
[ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[ 47.601565][ T1897] =============================================
OSV
CVE-2022-50258: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This
osv·2025-09-15·CVSS 7.8
CVE-2022-50258 [HIGH] CVE-2022-50258: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in brcmf_fil_iovar_data_get(). The patch ensures buf is null-terminated. Found by a modified version of syzkaller. [ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 47.601565][ T1897] =================================================
Red Hat
kernel: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
vendor_redhat·2025-09-15·CVSS 7.8
CVE-2022-50258 [HIGH] CWE-125 kernel: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
kernel: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
This patch fixes a stack-out-of-bounds read in brcmfmac that occurs
when 'buf' that is not null-terminated is passed as an argument of
strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware
version string by memcpy() in brcmf_fil_iovar_data_get().
The patch ensures buf is null-terminated.
Found by a modified version of syzkaller.
[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3
[ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited cha
Debian
CVE-2022-50258: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmf...
vendor_debian·2022·CVSS 7.8
CVE-2022-50258 [HIGH] CVE-2022-50258: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmf...
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in brcmf_fil_iovar_data_get(). The patch ensures buf is null-terminated. Found by a modified version of syzkaller. [ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 47.601565][ T1897] =================================================
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0a06cadcc2a0044e4a117cc0e61436fc3a0dad69https://git.kernel.org/stable/c/17dbe90e13f52848c460d253f15b765038ec6dc0https://git.kernel.org/stable/c/3a3a5e3f94068cd562d62a57da6983c8cd07d53chttps://git.kernel.org/stable/c/881f50d76c3892262730ddf5c894eb00310e736chttps://git.kernel.org/stable/c/89243a7b0ea19606ba1c2873c9d569026ccb344fhttps://git.kernel.org/stable/c/ba166e0ebdde3dfa833f0a3edaf2b2934d4a87f7https://git.kernel.org/stable/c/d481fd6064bf215d7c5068e15aa390c3b16c9cd0https://git.kernel.org/stable/c/d6ef66194bb4a6c18f5b9649bf62597909b040e4
2025-09-15
Published