CVE-2022-50880
Use-After-Free in Linux ath10k WiFi Peer Deletion
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qualcomm | ath10k | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free issue in the Linux kernel's ath10k WiFi driver. It occurs when the driver fails to properly clean up peer mappings during a disconnect operation. Specifically, multiple peer IDs can map to the same peer structure, and if deleting one peer fails, the structure is freed but still referenced by other peer IDs, leading to use-after-free errors detected by KFENCE.
How can this vulnerability impact me? :
The use-after-free vulnerability can cause system instability or crashes in devices using the affected ath10k WiFi driver. It may lead to unexpected behavior or denial of service due to kernel memory corruption when the driver accesses freed memory.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for specific peer map and use-after-free error messages related to ath10k. Look for logs indicating multiple HTT_T2H_MSG_TYPE_PEER_MAP entries for the same peer, failed peer delete operations, and KFENCE use-after-free errors in ath10k_sta_state(). Commands to check these logs include: `dmesg | grep ath10k`, `journalctl -k | grep ath10k`, or `dmesg | grep 'use-after-free'`.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the vulnerability is fixed by adding peer map clean up for peer delete in ath10k_sta_state(). This prevents use-after-free errors by properly cleaning up all peers in the peer_map array. Until an update is applied, monitoring logs for the issue and avoiding unstable disconnect operations may help reduce risk.