CVE-2022-50714
Use-After-Free Crash in Linux mt7921e WiFi Driver on Module Removal
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mt76 | mt7921e | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a crash issue in the Linux kernel's mt76 wireless driver, specifically the mt7921e component. It occurs during a stress test involving rapid insertion and removal of the driver module (insmod/rmmod). The crash is caused by a missing device reference (mt76_dev) in the mt7921_pci_remove() function, which leads to a use-after-free or invalid memory access when the driver is removed quickly before the probe() function has fully completed initialization.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash when the affected wireless driver module is removed quickly after being inserted. This can lead to system instability or downtime, especially in environments where the driver is frequently reloaded or updated. It may disrupt wireless connectivity and require a system reboot to recover.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by performing an insmod/rmmod stress test on the mt7921e driver. Specifically, load the driver module using 'insmod', do not bring the interface up (do not run 'ifup'), and then quickly remove the module using 'rmmod' within 1 second. If the system crashes or you see a kernel crash dump similar to the provided log (including KASAN user-memory-access errors related to mt7921_pci_remove), the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves avoiding the insmod/rmmod stress test sequence that triggers the crash. Specifically, do not quickly remove the mt7921e driver module after loading it without bringing the interface up. Wait for the probe() to finish properly before removing the module. Applying the patch that fixes the missing mt76_dev in mt7921_pci_remove() when it becomes available is the definitive fix.