CVE-2022-50716
published 2025-12-24CVE-2022-50716: In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out syzkaller reported…
PriorityP423
EPSS
0.25%
16.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
syzkaller reported use-after-free with the stack trace like below [1]:
[ 38.960489][ C3] ==================================================================
[ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240
[ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0
[ 38.966363][ C3]
[ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18
[ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
[ 38.969959][ C3] Call Trace:
[ 38.970841][ C3]
[ 38.971663][ C3] dump_stack_lvl+0xfc/0x174
[ 38.972620][ C3] print_report.cold+0x2c3/0x752
[ 38.973626][ C3] ? ar5523_cmd_tx_cb+0x220/0x240
[ 38.974644][ C3] kasan_report+0xb1/0x1d0
[ 38.975720][ C3] ? ar5523_cmd_tx_cb+0x220/0x240
[ 38.976831][ C3] ar5523_cmd_tx_cb+0x220/0x240
[ 38.978412][ C3] __usb_hcd_giveback_urb+0x353/0x5b0
[ 38.979755][ C3] usb_hcd_giveback_urb+0x385/0x430
[ 38.981266][ C3] dummy_timer+0x140c/0x34e0
[ 38.982925][ C3] ? notifier_call_chain+0xb5/0x1e0
[ 38.984761][ C3] ? rcu_read_lock_sched_held+0xb/0x60
[ 38.986242][ C3] ? lock_release+0x51c/0x790
[ 38.987323][ C3] ? _raw_read_unlock_irqrestore+0x37/0x70
[ 38.988483][ C3] ? __wake_up_common_lock+0xde/0x130
[ 38.989621][ C3] ? reacquire_held_locks+0x4a0/0x4a0
[ 38.990777][ C3] ? lock_acquire+0x472/0x550
[ 38.991919][ C3] ? rcu_read_lock_sched_held+0xb/0x60
[ 38.993138][ C3] ? lock_acquire+0x472/0x550
[ 38.994890][ C3] ? dummy_urb_enqueue+0x860/0x860
[ 38.996266][ C3] ? do_raw_spin_unlock+0x16f/0x230
[ 38.997670][ C3] ? dummy_urb_enqueue+0x860/0x860
[ 38.999116][ C3] call_timer_fn+0x1a0/0x6a0
[ 39.000668][ C3] ? add_timer_on+0x4a0/0x4a0
[ 39.002137][ C3] ? reacquire_held_locks+0x4a0/0x4a0
[ 39.003809][ C3] ? __next_timer_interrupt+0x226/0x2a0
[ 39.005509][ C3] __run_timers.part.0+0x69a/0xac0
[ 39.007025
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < c9ba3fbf6a488da6cad1d304c5234bd8d729eba3 | c9ba3fbf6a488da6cad1d304c5234bd8d729eba3 |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < 340524ae7b53a72cf5d9e7bd7790433422b3b12f | 340524ae7b53a72cf5d9e7bd7790433422b3b12f |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < 6447beefd21326a3f4719ec2ea511df797f6c820 | 6447beefd21326a3f4719ec2ea511df797f6c820 |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < 7360b323e0343ea099091d4ae09576dbe1f09516 | 7360b323e0343ea099091d4ae09576dbe1f09516 |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < 8af52492717e3538eba3f81d012b1476af8a89a6 | 8af52492717e3538eba3f81d012b1476af8a89a6 |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < 3eca9697c2f3905dea3ad2fc536ebaa1fbd735bd | 3eca9697c2f3905dea3ad2fc536ebaa1fbd735bd |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < 601ae89375033ac4870c086e24ba03f235d38e55 | 601ae89375033ac4870c086e24ba03f235d38e55 |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < 9aef34e1ae35a87e5f6a22278c17823b7ce64c88 | 9aef34e1ae35a87e5f6a22278c17823b7ce64c88 |
| linux | linux | >= b7d572e1871df06a96a1c9591c71c5494ff6b624 < b6702a942a069c2a975478d719e98d83cdae1797 | b6702a942a069c2a975478d719e98d83cdae1797 |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 3.8.0 < 4.9.337 | 4.9.337 |
| linux | linux_kernel | >= 4.10.0 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15.0 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20.0 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11.0 < 5.15.86 | 5.15.86 |
| linux | linux_kernel | >= 5.16.0 < 6.0.16 | 6.0.16 |
| linux | linux_kernel | >= 5.5.0 < 5.10.163 | 5.10.163 |
| linux | linux_kernel | >= 6.1.0 < 6.1.2 | 6.1.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
osv·2025-12-24
CVE-2022-50716 wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
In the Linux kernel, the following vulnerability has been resolved:
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
syzkaller reported use-after-free with the stack trace like below [1]:
[ 38.960489][ C3] ==================================================================
[ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240
[ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0
[ 38.966363][ C3]
[ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18
[ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
[ 38.969959][ C3] Call Trace:
[ 38.970841][ C3]
[ 38.971663][ C3] dump_stack_lvl+0
OSV
CVE-2022-50716: In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out syzkaller reported use-
osv·2025-12-24
CVE-2022-50716 CVE-2022-50716: In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out syzkaller reported use-
In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out syzkaller reported use-after-free with the stack trace like below [1]: [ 38.960489][ C3] ================================================================== [ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240 [ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0 [ 38.966363][ C3] [ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18 [ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 [ 38.969959][ C3] Call Trace: [ 38.970841][ C3] [ 38.971663][ C3] dump_stack_lvl+0xfc/0x174 [ 38.972620][ C3] print_report.cold+0x2c3/0x752 [ 38.
GHSA
GHSA-4m5x-vw6p-2w8c: In the Linux kernel, the following vulnerability has been resolved:
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
syzkaller reported us
ghsa_unreviewed·2025-12-24
CVE-2022-50716 GHSA-4m5x-vw6p-2w8c: In the Linux kernel, the following vulnerability has been resolved:
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
syzkaller reported us
In the Linux kernel, the following vulnerability has been resolved:
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
syzkaller reported use-after-free with the stack trace like below [1]:
[ 38.960489][ C3] ==================================================================
[ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240
[ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0
[ 38.966363][ C3]
[ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18
[ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
[ 38.969959][ C3] Call Trace:
[ 38.970841][ C3]
[ 38.971663][ C3] dump_stack_lvl+0xfc/0x174
[ 38.972620][ C3] print_report.cold+0x2c3/0x752
[
Red Hat
kernel: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
vendor_redhat·2025-12-24
CVE-2022-50716 kernel: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
kernel: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
In the Linux kernel, the following vulnerability has been resolved:
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
syzkaller reported use-after-free with the stack trace like below [1]:
[ 38.960489][ C3] ==================================================================
[ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240
[ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0
[ 38.966363][ C3]
[ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18
[ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
[ 38.969959][ C3] Call Trace:
[ 38.970841][ C3]
[ 38.971663][ C3] dump_stack_
Debian
CVE-2022-50716: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ar552...
vendor_debian·2022
CVE-2022-50716 CVE-2022-50716: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ar552...
In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out syzkaller reported use-after-free with the stack trace like below [1]: [ 38.960489][ C3] ================================================================== [ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240 [ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0 [ 38.966363][ C3] [ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18 [ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 [ 38.969959][ C3] Call Trace: [ 38.970841][ C3] [ 38.971663][ C3] dump_stack_lvl+0xfc/0x174 [ 38.972620][ C3] print_report.cold+0x2c3/0x752 [ 38.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-50716 kernel: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
bugzilla·2025-12-24
CVE-2022-50716 CVE-2022-50716 kernel: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
CVE-2022-50716 kernel: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
In the Linux kernel, the following vulnerability has been resolved:
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
syzkaller reported use-after-free with the stack trace like below [1]:
[ 38.960489][ C3] ==================================================================
[ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240
[ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0
[ 38.966363][ C3]
[ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18
[ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
[ 38.969959][ C3] Call Trace:
[ 38.970841][ C3]
[ 38.971663
Wiz
CVE-2022-50716 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50716 CVE-2022-50716 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50716 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
syzkaller reported use-after-free with the stack trace like below [1]:
[ 38.960489][ C3] ==================================================================
[ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240
[ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0
[ 38.966363][ C3]
[ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18
[ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
[ 38.969959][ C3] Call Trace:
[ 38.970841][ C3] [ 38.971663][ C3] dum
https://git.kernel.org/stable/c/340524ae7b53a72cf5d9e7bd7790433422b3b12fhttps://git.kernel.org/stable/c/3eca9697c2f3905dea3ad2fc536ebaa1fbd735bdhttps://git.kernel.org/stable/c/601ae89375033ac4870c086e24ba03f235d38e55https://git.kernel.org/stable/c/6447beefd21326a3f4719ec2ea511df797f6c820https://git.kernel.org/stable/c/7360b323e0343ea099091d4ae09576dbe1f09516https://git.kernel.org/stable/c/8af52492717e3538eba3f81d012b1476af8a89a6https://git.kernel.org/stable/c/9aef34e1ae35a87e5f6a22278c17823b7ce64c88https://git.kernel.org/stable/c/b6702a942a069c2a975478d719e98d83cdae1797https://git.kernel.org/stable/c/c9ba3fbf6a488da6cad1d304c5234bd8d729eba3
2025-12-24
Published