GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50701 (GCVE-0-2022-50701)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:55 – Updated: 2026-08-05 08:59
VLAI
Title
wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host SDIO may need addtional 511 bytes to align bus operation. If the tailroom of this skb is not big enough, we would access invalid memory region. For low level operation, increase skb size to keep valid memory access in SDIO host. Error message: [69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0 [69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451 [69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1 [69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300] [69.951] Call Trace: [69.951] <TASK> [69.952] dump_stack_lvl+0x49/0x63 [69.952] print_report+0x171/0x4a8 [69.952] kasan_report+0xb4/0x130 [69.952] kasan_check_range+0x149/0x1e0 [69.952] memcpy+0x24/0x70 [69.952] sg_copy_buffer+0xe9/0x1a0 [69.952] sg_copy_to_buffer+0x12/0x20 [69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300] [69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300] [69.952] process_one_work+0x7ee/0x1320 [69.952] worker_thread+0x53c/0x1240 [69.952] kthread+0x2b8/0x370 [69.952] ret_from_fork+0x1f/0x30 [69.952] </TASK> [69.952] Allocated by task 854: [69.952] kasan_save_stack+0x26/0x50 [69.952] kasan_set_track+0x25/0x30 [69.952] kasan_save_alloc_info+0x1b/0x30 [69.952] __kasan_kmalloc+0x87/0xa0 [69.952] __kmalloc_node_track_caller+0x63/0x150 [69.952] kmalloc_reserve+0x31/0xd0 [69.952] __alloc_skb+0xfc/0x2b0 [69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76] [69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76] [69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76] [69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib] [69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib] [69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common] [69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s] [69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common] [69.953] process_one_work+0x7ee/0x1320 [69.953] worker_thread+0x53c/0x1240 [69.953] kthread+0x2b8/0x370 [69.953] ret_from_fork+0x1f/0x30 [69.953] The buggy address belongs to the object at ffff88811c9ce800 which belongs to the cache kmalloc-2k of size 2048 [69.953] The buggy address is located 0 bytes to the right of 2048-byte region [ffff88811c9ce800, ffff88811c9cf000) [69.953] Memory state around the buggy address: [69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [69.953] ^ [69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 764dee47e2c1ed828c8a51cbf58f89b5e3ded11b , < 8b5174a7f25d03df0ffa171ff86de383a89e8e89 (git)
Affected: 764dee47e2c1ed828c8a51cbf58f89b5e3ded11b , < 0b358e36433d2c46a65488a146bf8b4623fc5bbb (git)
Affected: 764dee47e2c1ed828c8a51cbf58f89b5e3ded11b , < aec4cf2ea0797e28f18f8dbe01943a56d987fe56 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.16 , ≤ 6.1.* (semver)
Unaffected: 6.2.3 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/sdio_txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8b5174a7f25d03df0ffa171ff86de383a89e8e89",
              "status": "affected",
              "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b",
              "versionType": "git"
            },
            {
              "lessThan": "0b358e36433d2c46a65488a146bf8b4623fc5bbb",
              "status": "affected",
              "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b",
              "versionType": "git"
            },
            {
              "lessThan": "aec4cf2ea0797e28f18f8dbe01943a56d987fe56",
              "status": "affected",
              "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/sdio_txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host\n\nSDIO may need addtional 511 bytes to align bus operation. If the tailroom\nof this skb is not big enough, we would access invalid memory region.\nFor low level operation, increase skb size to keep valid memory access in\nSDIO host.\n\nError message:\n[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0\n[69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451\n[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W  OE  6.1.0-rc5 #1\n[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300]\n[69.951] Call Trace:\n[69.951]  \u003cTASK\u003e\n[69.952]  dump_stack_lvl+0x49/0x63\n[69.952]  print_report+0x171/0x4a8\n[69.952]  kasan_report+0xb4/0x130\n[69.952]  kasan_check_range+0x149/0x1e0\n[69.952]  memcpy+0x24/0x70\n[69.952]  sg_copy_buffer+0xe9/0x1a0\n[69.952]  sg_copy_to_buffer+0x12/0x20\n[69.952]  __command_write_data.isra.0+0x23c/0xbf0 [vub300]\n[69.952]  vub300_cmndwork_thread+0x17f3/0x58b0 [vub300]\n[69.952]  process_one_work+0x7ee/0x1320\n[69.952]  worker_thread+0x53c/0x1240\n[69.952]  kthread+0x2b8/0x370\n[69.952]  ret_from_fork+0x1f/0x30\n[69.952]  \u003c/TASK\u003e\n\n[69.952] Allocated by task 854:\n[69.952]  kasan_save_stack+0x26/0x50\n[69.952]  kasan_set_track+0x25/0x30\n[69.952]  kasan_save_alloc_info+0x1b/0x30\n[69.952]  __kasan_kmalloc+0x87/0xa0\n[69.952]  __kmalloc_node_track_caller+0x63/0x150\n[69.952]  kmalloc_reserve+0x31/0xd0\n[69.952]  __alloc_skb+0xfc/0x2b0\n[69.952]  __mt76_mcu_msg_alloc+0xbf/0x230 [mt76]\n[69.952]  mt76_mcu_send_and_get_msg+0xab/0x110 [mt76]\n[69.952]  __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76]\n[69.952]  mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib]\n[69.952]  mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib]\n[69.952]  mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common]\n[69.952]  mt7921s_mcu_init+0x45/0x80 [mt7921s]\n[69.953]  mt7921_init_work+0xe1/0x2a0 [mt7921_common]\n[69.953]  process_one_work+0x7ee/0x1320\n[69.953]  worker_thread+0x53c/0x1240\n[69.953]  kthread+0x2b8/0x370\n[69.953]  ret_from_fork+0x1f/0x30\n[69.953] The buggy address belongs to the object at ffff88811c9ce800\n             which belongs to the cache kmalloc-2k of size 2048\n[69.953] The buggy address is located 0 bytes to the right of\n             2048-byte region [ffff88811c9ce800, ffff88811c9cf000)\n\n[69.953] Memory state around the buggy address:\n[69.953]  ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953]  ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] \u003effff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953]                    ^\n[69.953]  ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953]  ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in mt76s_tx_run_queue()\u0027s pre-MCU firmware TX path (sdio_writesb of an undersized skb during mt7921_run_firmware), reached on local mt7921s SDIO probe/init or chip reset\u2014not via WiFi frame injection\u2014so Adjacent/Network do not apply.\nAC:L - Firmware scatter chunks up to 2048 bytes are sent while MCU_RUNNING is clear; __mt76s_xmit_queue() unconditionally roundups len to the 512-byte SDIO block size, so the OOB read is deterministic whenever tailroom is insufficient\u2014no race or attacker-uncontrollable layout is required.\nPR:L - The path runs during ordinary local driver bind/probe or reset recovery on systems with an mt7921s device; matching same-class mt7921 probe lifecycle scores, uncertainty between Low and High is resolved upward to Low.\nUI:N - Firmware download runs automatically from mt7921_init_work/mt7921s_mac_reset workqueues without a separate victim mount, open, or interactive step.\nS:U - The OOB access corrupts/reads host kernel slab within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - sdio_writesb reads up to 511 bytes past the skb allocation into adjacent kmalloc-2k slab (KASAN confirmed slab-out-of-bounds Read); per guidance, OOB reads not strictly bounded to a few bytes are Confidentiality High.\nI:N - KASAN and the fix show a pure out-of-bounds read into the SDIO write path; there is no OOB write, UAF, or other integrity/control-flow hijack primitive in the vulnerable code.\nA:H - Reading past the skb into unmapped or poisoned adjacent memory can oops/panic the kernel (as in the KASAN report via vub300/sg_copy_buffer), which is Availability High under kernel CVSS guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:26.804Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8b5174a7f25d03df0ffa171ff86de383a89e8e89"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b358e36433d2c46a65488a146bf8b4623fc5bbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/aec4cf2ea0797e28f18f8dbe01943a56d987fe56"
        }
      ],
      "title": "wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50701",
    "datePublished": "2025-12-24T10:55:17.090Z",
    "dateReserved": "2025-12-24T10:53:15.517Z",
    "dateUpdated": "2026-08-05T08:59:26.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50701",
      "date": "2026-09-14",
      "epss": "0.00144",
      "percentile": "0.04039"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50701\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:15:50.260\",\"lastModified\":\"2026-08-04T10:18:21.800\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host\\n\\nSDIO may need addtional 511 bytes to align bus operation. If the tailroom\\nof this skb is not big enough, we would access invalid memory region.\\nFor low level operation, increase skb size to keep valid memory access in\\nSDIO host.\\n\\nError message:\\n[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0\\n[69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451\\n[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W  OE  6.1.0-rc5 #1\\n[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300]\\n[69.951] Call Trace:\\n[69.951]  \u003cTASK\u003e\\n[69.952]  dump_stack_lvl+0x49/0x63\\n[69.952]  print_report+0x171/0x4a8\\n[69.952]  kasan_report+0xb4/0x130\\n[69.952]  kasan_check_range+0x149/0x1e0\\n[69.952]  memcpy+0x24/0x70\\n[69.952]  sg_copy_buffer+0xe9/0x1a0\\n[69.952]  sg_copy_to_buffer+0x12/0x20\\n[69.952]  __command_write_data.isra.0+0x23c/0xbf0 [vub300]\\n[69.952]  vub300_cmndwork_thread+0x17f3/0x58b0 [vub300]\\n[69.952]  process_one_work+0x7ee/0x1320\\n[69.952]  worker_thread+0x53c/0x1240\\n[69.952]  kthread+0x2b8/0x370\\n[69.952]  ret_from_fork+0x1f/0x30\\n[69.952]  \u003c/TASK\u003e\\n\\n[69.952] Allocated by task 854:\\n[69.952]  kasan_save_stack+0x26/0x50\\n[69.952]  kasan_set_track+0x25/0x30\\n[69.952]  kasan_save_alloc_info+0x1b/0x30\\n[69.952]  __kasan_kmalloc+0x87/0xa0\\n[69.952]  __kmalloc_node_track_caller+0x63/0x150\\n[69.952]  kmalloc_reserve+0x31/0xd0\\n[69.952]  __alloc_skb+0xfc/0x2b0\\n[69.952]  __mt76_mcu_msg_alloc+0xbf/0x230 [mt76]\\n[69.952]  mt76_mcu_send_and_get_msg+0xab/0x110 [mt76]\\n[69.952]  __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76]\\n[69.952]  mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib]\\n[69.952]  mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib]\\n[69.952]  mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common]\\n[69.952]  mt7921s_mcu_init+0x45/0x80 [mt7921s]\\n[69.953]  mt7921_init_work+0xe1/0x2a0 [mt7921_common]\\n[69.953]  process_one_work+0x7ee/0x1320\\n[69.953]  worker_thread+0x53c/0x1240\\n[69.953]  kthread+0x2b8/0x370\\n[69.953]  ret_from_fork+0x1f/0x30\\n[69.953] The buggy address belongs to the object at ffff88811c9ce800\\n             which belongs to the cache kmalloc-2k of size 2048\\n[69.953] The buggy address is located 0 bytes to the right of\\n             2048-byte region [ffff88811c9ce800, ffff88811c9cf000)\\n\\n[69.953] Memory state around the buggy address:\\n[69.953]  ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[69.953]  ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[69.953] \u003effff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n[69.953]                    ^\\n[69.953]  ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n[69.953]  ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/sdio_txrx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"764dee47e2c1ed828c8a51cbf58f89b5e3ded11b\",\"lessThan\":\"8b5174a7f25d03df0ffa171ff86de383a89e8e89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"764dee47e2c1ed828c8a51cbf58f89b5e3ded11b\",\"lessThan\":\"0b358e36433d2c46a65488a146bf8b4623fc5bbb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"764dee47e2c1ed828c8a51cbf58f89b5e3ded11b\",\"lessThan\":\"aec4cf2ea0797e28f18f8dbe01943a56d987fe56\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/sdio_txrx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.16\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.3\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b358e36433d2c46a65488a146bf8b4623fc5bbb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8b5174a7f25d03df0ffa171ff86de383a89e8e89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aec4cf2ea0797e28f18f8dbe01943a56d987fe56\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:37:46+00:00",
      "cve": "CVE-2022-50701",
      "id": "CVE-2022-50701",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "124",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50701.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.