GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50665 (GCVE-0-2022-50665)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:29 – Updated: 2026-08-05 08:59
VLAI
Title
wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected It has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(), as below, it will not print when debug_mask is not set ATH11K_DBG_DATA. ath11k_dbg(ab, ATH11K_DBG_DATA, "failed to find the peer with peer_id %d\n", ppdu_info.peer_id); When run scan with station disconnected, the peer_id is 0 for case HAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called from ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is reset to 0 in the while loop, so it does not match condition of the check "if (ppdu_info->peer_id == HAL_INVALID_PEERID" in the loop, and then the log "failed to find the peer with peer_id 0" print after the check in the loop, it is below call stack when debug_mask is set ATH11K_DBG_DATA. The reason is this commit 01d2f285e3e5 ("ath11k: decode HE status tlv") add "memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info))" in ath11k_dp_rx_process_mon_status(), but the commit does not initialize the peer_id to HAL_INVALID_PEERID, then lead the check mis-match. Callstack of the failed log: [12335.689072] RIP: 0010:ath11k_dp_rx_process_mon_status+0x9ea/0x1020 [ath11k] [12335.689157] Code: 89 ff e8 f9 10 00 00 be 01 00 00 00 4c 89 f7 e8 dc 4b 4e de 48 8b 85 38 ff ff ff c7 80 e4 07 00 00 01 00 00 00 e9 20 f8 ff ff <0f> 0b 41 0f b7 96 be 06 00 00 48 c7 c6 b8 50 44 c1 4c 89 ff e8 fd [12335.689180] RSP: 0018:ffffb874001a4ca0 EFLAGS: 00010246 [12335.689210] RAX: 0000000000000000 RBX: ffff995642cbd100 RCX: 0000000000000000 [12335.689229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99564212cd18 [12335.689248] RBP: ffffb874001a4dc0 R08: 0000000000000001 R09: 0000000000000000 [12335.689268] R10: 0000000000000220 R11: ffffb874001a48e8 R12: ffff995642473d40 [12335.689286] R13: ffff99564212c5b8 R14: ffff9956424736a0 R15: ffff995642120000 [12335.689303] FS: 0000000000000000(0000) GS:ffff995739000000(0000) knlGS:0000000000000000 [12335.689323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12335.689341] CR2: 00007f43c5d5e039 CR3: 000000011c012005 CR4: 00000000000606e0 [12335.689360] Call Trace: [12335.689377] <IRQ> [12335.689418] ? rcu_read_lock_held_common+0x12/0x50 [12335.689447] ? rcu_read_lock_sched_held+0x25/0x80 [12335.689471] ? rcu_read_lock_held_common+0x12/0x50 [12335.689504] ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k] [12335.689578] ? ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k] [12335.689653] ? lock_acquire+0xef/0x360 [12335.689681] ? rcu_read_lock_sched_held+0x25/0x80 [12335.689713] ath11k_dp_service_mon_ring+0x38/0x60 [ath11k] [12335.689784] ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k] [12335.689860] call_timer_fn+0xb2/0x2f0 [12335.689897] ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k] [12335.689970] run_timer_softirq+0x21f/0x540 [12335.689999] ? ktime_get+0xad/0x160 [12335.690025] ? lapic_next_deadline+0x2c/0x40 [12335.690053] ? clockevents_program_event+0x82/0x100 [12335.690093] __do_softirq+0x151/0x4a8 [12335.690135] irq_exit_rcu+0xc9/0x100 [12335.690165] sysvec_apic_timer_interrupt+0xa8/0xd0 [12335.690189] </IRQ> [12335.690204] <TASK> [12335.690225] asm_sysvec_apic_timer_interrupt+0x12/0x20 Reset the default value to HAL_INVALID_PEERID each time after memset of ppdu_info as well as others memset which existed in function ath11k_dp_rx_process_mon_status(), then the failed log disappeared. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
Severity
7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 01d2f285e3e5b629df9c61514e7ee07a54d0eed9 , < c0bb97a90b133416b50b3ffbdb7efca9253cc687 (git)
Affected: 01d2f285e3e5b629df9c61514e7ee07a54d0eed9 , < a5b03df19041e5ce35c7f048fa84bf1b0ceb1311 (git)
Affected: 01d2f285e3e5b629df9c61514e7ee07a54d0eed9 , < a20ed60bb357776301c2dad7b4a4f0db97e143e9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/dp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c0bb97a90b133416b50b3ffbdb7efca9253cc687",
              "status": "affected",
              "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
              "versionType": "git"
            },
            {
              "lessThan": "a5b03df19041e5ce35c7f048fa84bf1b0ceb1311",
              "status": "affected",
              "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
              "versionType": "git"
            },
            {
              "lessThan": "a20ed60bb357776301c2dad7b4a4f0db97e143e9",
              "status": "affected",
              "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath11k/dp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected\n\nIt has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(),\nas below, it will not print when debug_mask is not set ATH11K_DBG_DATA.\n\tath11k_dbg(ab, ATH11K_DBG_DATA,\n\t\t  \"failed to find the peer with peer_id %d\\n\",\n\t\t   ppdu_info.peer_id);\n\nWhen run scan with station disconnected, the peer_id is 0 for case\nHAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called\nfrom ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is\nreset to 0 in the while loop, so it does not match condition of the\ncheck \"if (ppdu_info-\u003epeer_id == HAL_INVALID_PEERID\" in the loop, and\nthen the log \"failed to find the peer with peer_id 0\" print after the\ncheck in the loop, it is below call stack when debug_mask is set\nATH11K_DBG_DATA.\n\nThe reason is this commit 01d2f285e3e5 (\"ath11k: decode HE status tlv\")\nadd \"memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info))\" in\nath11k_dp_rx_process_mon_status(), but the commit does not initialize\nthe peer_id to HAL_INVALID_PEERID, then lead the check mis-match.\n\nCallstack of the failed log:\n[12335.689072] RIP: 0010:ath11k_dp_rx_process_mon_status+0x9ea/0x1020 [ath11k]\n[12335.689157] Code: 89 ff e8 f9 10 00 00 be 01 00 00 00 4c 89 f7 e8 dc 4b 4e de 48 8b 85 38 ff ff ff c7 80 e4 07 00 00 01 00 00 00 e9 20 f8 ff ff \u003c0f\u003e 0b 41 0f b7 96 be 06 00 00 48 c7 c6 b8 50 44 c1 4c 89 ff e8 fd\n[12335.689180] RSP: 0018:ffffb874001a4ca0 EFLAGS: 00010246\n[12335.689210] RAX: 0000000000000000 RBX: ffff995642cbd100 RCX: 0000000000000000\n[12335.689229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99564212cd18\n[12335.689248] RBP: ffffb874001a4dc0 R08: 0000000000000001 R09: 0000000000000000\n[12335.689268] R10: 0000000000000220 R11: ffffb874001a48e8 R12: ffff995642473d40\n[12335.689286] R13: ffff99564212c5b8 R14: ffff9956424736a0 R15: ffff995642120000\n[12335.689303] FS:  0000000000000000(0000) GS:ffff995739000000(0000) knlGS:0000000000000000\n[12335.689323] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[12335.689341] CR2: 00007f43c5d5e039 CR3: 000000011c012005 CR4: 00000000000606e0\n[12335.689360] Call Trace:\n[12335.689377]  \u003cIRQ\u003e\n[12335.689418]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689447]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689471]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689504]  ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689578]  ? ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689653]  ? lock_acquire+0xef/0x360\n[12335.689681]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689713]  ath11k_dp_service_mon_ring+0x38/0x60 [ath11k]\n[12335.689784]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689860]  call_timer_fn+0xb2/0x2f0\n[12335.689897]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689970]  run_timer_softirq+0x21f/0x540\n[12335.689999]  ? ktime_get+0xad/0x160\n[12335.690025]  ? lapic_next_deadline+0x2c/0x40\n[12335.690053]  ? clockevents_program_event+0x82/0x100\n[12335.690093]  __do_softirq+0x151/0x4a8\n[12335.690135]  irq_exit_rcu+0xc9/0x100\n[12335.690165]  sysvec_apic_timer_interrupt+0xa8/0xd0\n[12335.690189]  \u003c/IRQ\u003e\n[12335.690204]  \u003cTASK\u003e\n[12335.690225]  asm_sysvec_apic_timer_interrupt+0x12/0x20\n\nReset the default value to HAL_INVALID_PEERID each time after memset\nof ppdu_info as well as others memset which existed in function\nath11k_dp_rx_process_mon_status(), then the failed log disappeared.\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable path processes ath11k monitor-status TLVs derived from over-the-air WiFi frames via the RXDMA monitor-status ring (timer/NAPI softirq), so an attacker on the same radio segment can trigger it by injecting frames while the interface is up or scanning.\nAC:L - Firmware commonly reports peer_id 0 for non-associated frames, and after memset that value bypasses the HAL_INVALID_PEERID skip; an adjacent attacker can reliably produce such status completions without depending on races or uncontrolled timing.\nPR:N - No local account or capability is required; unauthenticated adjacent WiFi traffic is enough once the ath11k MAC has enabled the default monitor-status filter at start.\nUI:N - Monitor-status collection is enabled by default in ath11k_mac_op_start, and background scans/idle RX occur without any explicit victim action.\nS:U - Impact stays within the same kernel/host security authority; there is no VM, IOMMU, or other cross-boundary escape.\nC:N - The bug only mis-handles peer_id validation and may update local RX stats or emit a debug/warning path; it does not disclose kernel or peer memory to the attacker.\nI:L - When a real peer with id 0 exists, unrelated frames are attributed to that peer and ath11k_dp_rx_update_peer_stats corrupts limited station metrics (RSSI, RX counters, duration) used for rate/roaming decisions, without yielding arbitrary write or code execution.\nA:H - The CVE-documented failure path manifests as a kernel warning/oops-style ud2 hit in ath11k_dp_rx_process_mon_status while processing these status buffers, which is treated as high availability impact for kernel CVEs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:17.083Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c0bb97a90b133416b50b3ffbdb7efca9253cc687"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5b03df19041e5ce35c7f048fa84bf1b0ceb1311"
        },
        {
          "url": "https://git.kernel.org/stable/c/a20ed60bb357776301c2dad7b4a4f0db97e143e9"
        }
      ],
      "title": "wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50665",
    "datePublished": "2025-12-09T01:29:15.255Z",
    "dateReserved": "2025-12-09T01:26:45.990Z",
    "dateUpdated": "2026-08-05T08:59:17.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50665",
      "date": "2026-09-19",
      "epss": "0.00326",
      "percentile": "0.2588"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath11k/dp_rx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c0bb97a90b133416b50b3ffbdb7efca9253cc687",
                    "status": "affected",
                    "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a5b03df19041e5ce35c7f048fa84bf1b0ceb1311",
                    "status": "affected",
                    "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a20ed60bb357776301c2dad7b4a4f0db97e143e9",
                    "status": "affected",
                    "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/ath/ath11k/dp_rx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected\n\nIt has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(),\nas below, it will not print when debug_mask is not set ATH11K_DBG_DATA.\n\tath11k_dbg(ab, ATH11K_DBG_DATA,\n\t\t  \"failed to find the peer with peer_id %d\\n\",\n\t\t   ppdu_info.peer_id);\n\nWhen run scan with station disconnected, the peer_id is 0 for case\nHAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called\nfrom ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is\nreset to 0 in the while loop, so it does not match condition of the\ncheck \"if (ppdu_info-\u003epeer_id == HAL_INVALID_PEERID\" in the loop, and\nthen the log \"failed to find the peer with peer_id 0\" print after the\ncheck in the loop, it is below call stack when debug_mask is set\nATH11K_DBG_DATA.\n\nThe reason is this commit 01d2f285e3e5 (\"ath11k: decode HE status tlv\")\nadd \"memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info))\" in\nath11k_dp_rx_process_mon_status(), but the commit does not initialize\nthe peer_id to HAL_INVALID_PEERID, then lead the check mis-match.\n\nCallstack of the failed log:\n[12335.689072] RIP: 0010:ath11k_dp_rx_process_mon_status+0x9ea/0x1020 [ath11k]\n[12335.689157] Code: 89 ff e8 f9 10 00 00 be 01 00 00 00 4c 89 f7 e8 dc 4b 4e de 48 8b 85 38 ff ff ff c7 80 e4 07 00 00 01 00 00 00 e9 20 f8 ff ff \u003c0f\u003e 0b 41 0f b7 96 be 06 00 00 48 c7 c6 b8 50 44 c1 4c 89 ff e8 fd\n[12335.689180] RSP: 0018:ffffb874001a4ca0 EFLAGS: 00010246\n[12335.689210] RAX: 0000000000000000 RBX: ffff995642cbd100 RCX: 0000000000000000\n[12335.689229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99564212cd18\n[12335.689248] RBP: ffffb874001a4dc0 R08: 0000000000000001 R09: 0000000000000000\n[12335.689268] R10: 0000000000000220 R11: ffffb874001a48e8 R12: ffff995642473d40\n[12335.689286] R13: ffff99564212c5b8 R14: ffff9956424736a0 R15: ffff995642120000\n[12335.689303] FS:  0000000000000000(0000) GS:ffff995739000000(0000) knlGS:0000000000000000\n[12335.689323] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[12335.689341] CR2: 00007f43c5d5e039 CR3: 000000011c012005 CR4: 00000000000606e0\n[12335.689360] Call Trace:\n[12335.689377]  \u003cIRQ\u003e\n[12335.689418]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689447]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689471]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689504]  ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689578]  ? ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689653]  ? lock_acquire+0xef/0x360\n[12335.689681]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689713]  ath11k_dp_service_mon_ring+0x38/0x60 [ath11k]\n[12335.689784]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689860]  call_timer_fn+0xb2/0x2f0\n[12335.689897]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689970]  run_timer_softirq+0x21f/0x540\n[12335.689999]  ? ktime_get+0xad/0x160\n[12335.690025]  ? lapic_next_deadline+0x2c/0x40\n[12335.690053]  ? clockevents_program_event+0x82/0x100\n[12335.690093]  __do_softirq+0x151/0x4a8\n[12335.690135]  irq_exit_rcu+0xc9/0x100\n[12335.690165]  sysvec_apic_timer_interrupt+0xa8/0xd0\n[12335.690189]  \u003c/IRQ\u003e\n[12335.690204]  \u003cTASK\u003e\n[12335.690225]  asm_sysvec_apic_timer_interrupt+0x12/0x20\n\nReset the default value to HAL_INVALID_PEERID each time after memset\nof ppdu_info as well as others memset which existed in function\nath11k_dp_rx_process_mon_status(), then the failed log disappeared.\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"
          }
        ],
        "id": "CVE-2022-50665",
        "lastModified": "2026-08-04T10:18:20.553",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-09T16:17:18.480",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a20ed60bb357776301c2dad7b4a4f0db97e143e9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a5b03df19041e5ce35c7f048fa84bf1b0ceb1311"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c0bb97a90b133416b50b3ffbdb7efca9253cc687"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-14T18:50:39+00:00",
      "cve": "CVE-2022-50665",
      "id": "CVE-2022-50665",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50665.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.