CVE-2022-50678
published 2025-12-09CVE-2022-50678: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variable i is…
PriorityP424medium5.5
EPSS
0.23%
13.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
The variable i is changed when setting random MAC address and causes
invalid address access when printing the value of pi->reqs[i]->reqid.
We replace reqs index with ri to fix the issue.
[ 136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
[ 136.737365] Mem abort info:
[ 136.740172] ESR = 0x96000004
[ 136.743359] Exception class = DABT (current EL), IL = 32 bits
[ 136.749294] SET = 0, FnV = 0
[ 136.752481] EA = 0, S1PTW = 0
[ 136.755635] Data abort info:
[ 136.758514] ISV = 0, ISS = 0x00000004
[ 136.762487] CM = 0, WnR = 0
[ 136.765522] user pgtable: 4k pages, 48-bit VAs, pgdp = 000000005c4e2577
[ 136.772265] [0000000000000000] pgd=0000000000000000
[ 136.777160] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[ 136.782732] Modules linked in: brcmfmac(O) brcmutil(O) cfg80211(O) compat(O)
[ 136.789788] Process wificond (pid: 3175, stack limit = 0x00000000053048fb)
[ 136.796664] CPU: 3 PID: 3175 Comm: wificond Tainted: G O 4.19.42-00001-g531a5f5 #1
[ 136.805532] Hardware name: Freescale i.MX8MQ EVK (DT)
[ 136.810584] pstate: 60400005 (nZCv daif +PAN -UAO)
[ 136.815429] pc : brcmf_pno_config_sched_scans+0x6cc/0xa80 [brcmfmac]
[ 136.821811] lr : brcmf_pno_config_sched_scans+0x67c/0xa80 [brcmfmac]
[ 136.828162] sp : ffff00000e9a3880
[ 136.831475] x29: ffff00000e9a3890 x28: ffff800020543400
[ 136.836786] x27: ffff8000b1008880 x26: ffff0000012bf6a0
[ 136.842098] x25: ffff80002054345c x24: ffff800088d22400
[ 136.847409] x23: ffff0000012bf638 x22: ffff0000012bf6d8
[ 136.852721] x21: ffff8000aced8fc0 x20: ffff8000ac164400
[ 136.858032] x19: ffff00000e9a3946 x18: 0000000000000000
[ 136.863343] x17: 0000000000000000 x16: 0000000000000000
[ 136.868655] x15: ffff0000093f3b37 x14: 0000000000000050
[ 136.873966] x13: 0000000000003135 x12: 0000000000000000
[ 136.879277] x11:
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.3-1 (bookworm) | linux 6.0.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= efc2c1fa8e145b60a7805fa9b6c92ac0746fccc3 < 7ccb0529446ae68a8581916bfc95c353306d76ba | 7ccb0529446ae68a8581916bfc95c353306d76ba |
| linux | linux | >= efc2c1fa8e145b60a7805fa9b6c92ac0746fccc3 < 1c12d47a9017a7745585b57b9b0fdc0d8c50978e | 1c12d47a9017a7745585b57b9b0fdc0d8c50978e |
| linux | linux | >= efc2c1fa8e145b60a7805fa9b6c92ac0746fccc3 < 56a0ac48634155d2b866b99fba7e1dd8df4e2804 | 56a0ac48634155d2b866b99fba7e1dd8df4e2804 |
| linux | linux | >= efc2c1fa8e145b60a7805fa9b6c92ac0746fccc3 < 50e45034c5802cedbf5b707364ea76ace29ad984 | 50e45034c5802cedbf5b707364ea76ace29ad984 |
| linux | linux | >= efc2c1fa8e145b60a7805fa9b6c92ac0746fccc3 < 75995ce1c926ee87bf93d58977c766b4e7744715 | 75995ce1c926ee87bf93d58977c766b4e7744715 |
| linux | linux | >= efc2c1fa8e145b60a7805fa9b6c92ac0746fccc3 < 4d4dcfa6b4e85a878401f4fbae4cafc88cdcceb4 | 4d4dcfa6b4e85a878401f4fbae4cafc88cdcceb4 |
| linux | linux | >= efc2c1fa8e145b60a7805fa9b6c92ac0746fccc3 < 826405a911473b6ee8bd2aa891cb2f03a13efa17 | 826405a911473b6ee8bd2aa891cb2f03a13efa17 |
| linux | linux | >= efc2c1fa8e145b60a7805fa9b6c92ac0746fccc3 < aa666b68e73fc06d83c070d96180b9010cf5a960 | aa666b68e73fc06d83c070d96180b9010cf5a960 |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 4.13.0 < 4.14.296 | 4.14.296 |
| linux | linux_kernel | >= 4.15.0 < 4.19.262 | 4.19.262 |
| linux | linux_kernel | >= 4.20.0 < 5.4.220 | 5.4.220 |
| linux | linux_kernel | >= 5.11.0 < 5.15.75 | 5.15.75 |
| linux | linux_kernel | >= 5.16.0 < 5.19.17 | 5.19.17 |
| linux | linux_kernel | >= 5.20.0 < 6.0.3 | 6.0.3 |
| linux | linux_kernel | >= 5.5.0 < 5.10.150 | 5.10.150 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-50678: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variab
osv·2025-12-09
CVE-2022-50678 CVE-2022-50678: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variab
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variable i is changed when setting random MAC address and causes invalid address access when printing the value of pi->reqs[i]->reqid. We replace reqs index with ri to fix the issue. [ 136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000 [ 136.737365] Mem abort info: [ 136.740172] ESR = 0x96000004 [ 136.743359] Exception class = DABT (current EL), IL = 32 bits [ 136.749294] SET = 0, FnV = 0 [ 136.752481] EA = 0, S1PTW = 0 [ 136.755635] Data abort info: [ 136.758514] ISV = 0, ISS = 0x00000004 [ 136.762487] CM = 0, WnR = 0 [ 136.765522] user pgtable: 4k pages, 48-bit VAs, pgdp = 000000
GHSA
GHSA-4429-w779-rp6q: In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
The vari
ghsa_unreviewed·2025-12-09
CVE-2022-50678 GHSA-4429-w779-rp6q: In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
The vari
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
The variable i is changed when setting random MAC address and causes
invalid address access when printing the value of pi->reqs[i]->reqid.
We replace reqs index with ri to fix the issue.
[ 136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
[ 136.737365] Mem abort info:
[ 136.740172] ESR = 0x96000004
[ 136.743359] Exception class = DABT (current EL), IL = 32 bits
[ 136.749294] SET = 0, FnV = 0
[ 136.752481] EA = 0, S1PTW = 0
[ 136.755635] Data abort info:
[ 136.758514] ISV = 0, ISS = 0x00000004
[ 136.762487] CM = 0, WnR = 0
[ 136.765522] user pgtable: 4k pages, 48-bit VAs, pgdp = 00
OSV
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
osv·2025-12-09
CVE-2022-50678 wifi: brcmfmac: fix invalid address access when enabling SCAN log level
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
The variable i is changed when setting random MAC address and causes
invalid address access when printing the value of pi->reqs[i]->reqid.
We replace reqs index with ri to fix the issue.
[ 136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
[ 136.737365] Mem abort info:
[ 136.740172] ESR = 0x96000004
[ 136.743359] Exception class = DABT (current EL), IL = 32 bits
[ 136.749294] SET = 0, FnV = 0
[ 136.752481] EA = 0, S1PTW = 0
[ 136.755635] Data abort info:
[ 136.758514] ISV = 0, ISS = 0x00000004
[ 136.762487] CM
Red Hat
kernel: wifi: brcmfmac: fix invalid address access when enabling SCAN log level
vendor_redhat·2025-12-09·CVSS 5.5
CVE-2022-50678 [MEDIUM] kernel: wifi: brcmfmac: fix invalid address access when enabling SCAN log level
kernel: wifi: brcmfmac: fix invalid address access when enabling SCAN log level
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
The variable i is changed when setting random MAC address and causes
invalid address access when printing the value of pi->reqs[i]->reqid.
We replace reqs index with ri to fix the issue.
[ 136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000
[ 136.737365] Mem abort info:
[ 136.740172] ESR = 0x96000004
[ 136.743359] Exception class = DABT (current EL), IL = 32 bits
[ 136.749294] SET = 0, FnV = 0
[ 136.752481] EA = 0, S1PTW = 0
[ 136.755635] Data abort info:
[ 136.758514] ISV = 0, ISS = 0x00000004
[ 136.762487
Debian
CVE-2022-50678: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmf...
vendor_debian·2022
CVE-2022-50678 CVE-2022-50678: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmf...
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variable i is changed when setting random MAC address and causes invalid address access when printing the value of pi->reqs[i]->reqid. We replace reqs index with ri to fix the issue. [ 136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000 [ 136.737365] Mem abort info: [ 136.740172] ESR = 0x96000004 [ 136.743359] Exception class = DABT (current EL), IL = 32 bits [ 136.749294] SET = 0, FnV = 0 [ 136.752481] EA = 0, S1PTW = 0 [ 136.755635] Data abort info: [ 136.758514] ISV = 0, ISS = 0x00000004 [ 136.762487] CM = 0, WnR = 0 [ 136.765522] user pgtable: 4k pages, 48-bit VAs, pgdp = 000000
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1c12d47a9017a7745585b57b9b0fdc0d8c50978ehttps://git.kernel.org/stable/c/4d4dcfa6b4e85a878401f4fbae4cafc88cdcceb4https://git.kernel.org/stable/c/50e45034c5802cedbf5b707364ea76ace29ad984https://git.kernel.org/stable/c/56a0ac48634155d2b866b99fba7e1dd8df4e2804https://git.kernel.org/stable/c/75995ce1c926ee87bf93d58977c766b4e7744715https://git.kernel.org/stable/c/7ccb0529446ae68a8581916bfc95c353306d76bahttps://git.kernel.org/stable/c/826405a911473b6ee8bd2aa891cb2f03a13efa17https://git.kernel.org/stable/c/aa666b68e73fc06d83c070d96180b9010cf5a960
2025-12-09
Published