CVE-2022-50700
Use-After-Free in Linux ath10k Driver Causes Kernel Panic on WCN
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qualcomm | wcn3990 | * |
| qualcomm | ath10k | * |
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's ath10k wifi driver on the WCN3990 hardware. The issue arises because the copy engine hardware sends a copy complete interrupt to the host driver while it is still processing the buffer. The driver then immediately unmaps and frees the buffer, assuming the hardware is done with it. However, since the hardware is still accessing the buffer, this causes an SMMU fault that triggers a kernel panic. The fix involves adding a delay before unmapping the DMA buffer to ensure the hardware has finished processing it.
How can this vulnerability impact me? :
This vulnerability can cause a kernel panic on affected systems, leading to system crashes and potential denial of service. This instability can disrupt normal operation of devices using the affected wifi driver and hardware, potentially causing loss of connectivity and requiring system reboots.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the kernel logs for specific crash signatures related to the ath10k driver and SMMU faults. Look for messages such as 'wifi smmu error', 'Unhandled context fault', and 'fatal error received' in the kernel log. You can use commands like 'dmesg | grep -i smmu' or 'journalctl -k | grep -i ath10k' to find relevant error messages indicating the issue.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, apply the workaround that delays the unmapping of the copy engine source DMA buffer specifically for the WCN3990 hardware on copy engine channel 3 (CE3). This prevents the SMMU fault by ensuring the hardware has finished processing the buffer before it is unmapped and freed. If a patch is available from your Linux kernel vendor that includes this fix, apply it promptly to avoid kernel panics.