CVE-2022-50880
published 2025-12-30CVE-2022-50880: In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() When peer delete…
PriorityP345high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.32%
23.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only one struct ath10k_peer, it is allocated in
ath10k_peer_map_event(). When connected to an AP, it has more than
one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the
array peer_map of struct ath10k will be set muti-elements to the
same ath10k_peer in ath10k_peer_map_event(). When peer delete failed
in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer
id in array peer_map of struct ath10k, and then use-after-free happened
for the 2nd peer id because they map to the same ath10k_peer.
And clean up all peers in array peer_map for the ath10k_peer, then
user-after-free disappeared
peer map event log:
[ 306.911021] wlan0: authenticate with b0:2a:43:e6:75:0e
[ 306.957187] ath10k_pci 0000:01:00.0: mac vdev 0 peer create b0:2a:43:e6:75:0e (new sta) sta 1 / 32 peer 1 / 33
[ 306.957395] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 246
[ 306.957404] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 198
[ 306.986924] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 166
peer unmap event log:
[ 435.715691] wlan0: deauthenticating from b0:2a:43:e6:75:0e by local choice (Reason: 3=DEAUTH_LEAVING)
[ 435.716802] ath10k_pci 0000:01:00.0: mac vdev 0 peer delete b0:2a:43:e6:75:0e sta ffff990e0e9c2b50 (sta gone)
[ 435.717177] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 246
[ 435.717186] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 198
[ 435.717193] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 166
use-after-free log:
[21705.888627] wlan0: deauthenticating from d0:76:8f:82:be:75 by local choice (Reason: 3=DEAUTH_LEAVING)
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.3-1 (bookworm) | linux 6.0.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < 15604ab67179ae27ea3c7fb24b6df32b143257c4 | 15604ab67179ae27ea3c7fb24b6df32b143257c4 |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < 2d6259715c9597a6cfa25db8911683eb0073b1c6 | 2d6259715c9597a6cfa25db8911683eb0073b1c6 |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < f12fc305c127bd07bb50373e29c6037696f916a8 | f12fc305c127bd07bb50373e29c6037696f916a8 |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < 4494ec1c0bb850eaa80fed98e5b041d961011d3e | 4494ec1c0bb850eaa80fed98e5b041d961011d3e |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < 08faf07717be0c88b02b5aa45aad2225dfcdd2dc | 08faf07717be0c88b02b5aa45aad2225dfcdd2dc |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < 54a3201f3c1ff813523937da78b5fa7649dbab71 | 54a3201f3c1ff813523937da78b5fa7649dbab71 |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < 2bf916418d2141b810c40812433ab4ecfd3c2934 | 2bf916418d2141b810c40812433ab4ecfd3c2934 |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < 38245f2d62cd4d1f38a763a7b4045ab4565b30a0 | 38245f2d62cd4d1f38a763a7b4045ab4565b30a0 |
| linux | linux | >= d0eeafad118940fe445ca00f45be5624fea2ec34 < f020d9570a04df0762a2ac5c50cf1d8c511c9164 | f020d9570a04df0762a2ac5c50cf1d8c511c9164 |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 4.10.0 < 4.14.296 | 4.14.296 |
| linux | linux_kernel | >= 4.15.0 < 4.19.262 | 4.19.262 |
| linux | linux_kernel | >= 4.20.0 < 5.4.220 | 5.4.220 |
| linux | linux_kernel | >= 4.8.0 < 4.9.331 | 4.9.331 |
| linux | linux_kernel | >= 5.11.0 < 5.15.75 | 5.15.75 |
| linux | linux_kernel | >= 5.16.0 < 5.19.17 | 5.19.17 |
| linux | linux_kernel | >= 5.20.0 < 6.0.3 | 6.0.3 |
| linux | linux_kernel | >= 5.5.0 < 5.10.150 | 5.10.150 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pjr7-jcmf-p5h8: In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When p
ghsa_unreviewed·2025-12-30
CVE-2022-50880 GHSA-pjr7-jcmf-p5h8: In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When p
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only one struct ath10k_peer, it is allocated in
ath10k_peer_map_event(). When connected to an AP, it has more than
one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the
array peer_map of struct ath10k will be set muti-elements to the
same ath10k_peer in ath10k_peer_map_event(). When peer delete failed
in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer
id in array peer_map of struct ath10k, and then use-after-free happened
for the 2nd peer id because they map to the same ath1
OSV
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
osv·2025-12-30
CVE-2022-50880 wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only one struct ath10k_peer, it is allocated in
ath10k_peer_map_event(). When connected to an AP, it has more than
one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the
array peer_map of struct ath10k will be set muti-elements to the
same ath10k_peer in ath10k_peer_map_event(). When peer delete failed
in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer
id in array peer_map of struct ath10k, and then us
OSV
CVE-2022-50880: In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() When pee
osv·2025-12-30
CVE-2022-50880 CVE-2022-50880: In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() When pee
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdev_id and address, it has only one struct ath10k_peer, it is allocated in ath10k_peer_map_event(). When connected to an AP, it has more than one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the array peer_map of struct ath10k will be set muti-elements to the same ath10k_peer in ath10k_peer_map_event(). When peer delete failed in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer id in array peer_map of struct ath10k, and then use-after-free happened for the 2nd peer id because they map to the same ath10k
Red Hat
kernel: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
vendor_redhat·2025-12-30·CVSS 6.4
CVE-2022-50880 [MEDIUM] CWE-416 kernel: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
kernel: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only one struct ath10k_peer, it is allocated in
ath10k_peer_map_event(). When connected to an AP, it has more than
one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the
array peer_map of struct ath10k will be set muti-elements to the
same ath10k_peer in ath10k_peer_map_event(). When peer delete failed
in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer
id in array peer_map of struct ath10k, and t
Debian
CVE-2022-50880: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath10...
vendor_debian·2022
CVE-2022-50880 CVE-2022-50880: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath10...
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdev_id and address, it has only one struct ath10k_peer, it is allocated in ath10k_peer_map_event(). When connected to an AP, it has more than one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the array peer_map of struct ath10k will be set muti-elements to the same ath10k_peer in ath10k_peer_map_event(). When peer delete failed in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer id in array peer_map of struct ath10k, and then use-after-free happened for the 2nd peer id because they map to the same ath10k
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-50880 kernel: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
bugzilla·2025-12-30
CVE-2022-50880 [MEDIUM] CVE-2022-50880 kernel: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
CVE-2022-50880 kernel: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only one struct ath10k_peer, it is allocated in
ath10k_peer_map_event(). When connected to an AP, it has more than
one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the
array peer_map of struct ath10k will be set muti-elements to the
same ath10k_peer in ath10k_peer_map_event(). When peer delete failed
in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer
id in array peer_map of str
Wiz
CVE-2022-50880 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50880 CVE-2022-50880 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50880 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
When peer delete failed in a disconnect operation, use-after-free
detected by KFENCE in below log. It is because for each vdev_id and
address, it has only one struct ath10k_peer, it is allocated in
ath10k_peer_map_event(). When connected to an AP, it has more than
one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the
array peer_map of struct ath10k will be set muti-elements to the
same ath10k_peer in ath10k_peer_map_event(). When peer delete failed
in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer
id in array peer_map of struct ath10k, and then use-
https://git.kernel.org/stable/c/08faf07717be0c88b02b5aa45aad2225dfcdd2dchttps://git.kernel.org/stable/c/15604ab67179ae27ea3c7fb24b6df32b143257c4https://git.kernel.org/stable/c/2bf916418d2141b810c40812433ab4ecfd3c2934https://git.kernel.org/stable/c/2d6259715c9597a6cfa25db8911683eb0073b1c6https://git.kernel.org/stable/c/38245f2d62cd4d1f38a763a7b4045ab4565b30a0https://git.kernel.org/stable/c/4494ec1c0bb850eaa80fed98e5b041d961011d3ehttps://git.kernel.org/stable/c/54a3201f3c1ff813523937da78b5fa7649dbab71https://git.kernel.org/stable/c/f020d9570a04df0762a2ac5c50cf1d8c511c9164https://git.kernel.org/stable/c/f12fc305c127bd07bb50373e29c6037696f916a8
2025-12-30
Published