CVE-2022-50735
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-50735
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50735.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-50735
- Downstream
- Published
- 2025-12-24T12:22:54.004Z
- Modified
- 2026-01-02T20:27:22.271719Z
- Summary
- wifi: mt76: do not run mt76u_status_worker if the device is not running
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: do not run mt76ustatusworker if the device is not running
Fix the following NULL pointer dereference avoiding to run mt76ustatusworker thread if the device is not running yet.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 98 Comm: kworker/u2:2 Not tainted 5.14.0+ #78 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: mt76 mt76utxstatusdata RIP: 0010:mt76x02macfilltxstatus.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: mt76x02sendtxstatus+0x1d2/0xeb0 mt76x02txstatusdata+0x8e/0xd0 mt76utxstatusdata+0xe1/0x240 processonework+0x92b/0x1460 workerthread+0x95/0xe00 kthread+0x3a1/0x480 retfromfork+0x1f/0x30 Modules linked in: --[ end trace 8df5d20fc5040f65 ]-- RIP: 0010:mt76x02macfilltx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554
Moreover move stat_work schedule out of the for loop.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50735.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/58fdd84a89b121b761dbfb8a196356e007376ca4
- https://git.kernel.org/stable/c/69346de0eb956fb92949b9473de4647d9c34a54f
- https://git.kernel.org/stable/c/bd5dac7ced5a7c9faa4dc468ac9560c3256df845
- https://git.kernel.org/stable/c/f5ac749a0b21beee55d87d0b05de36976b22dff9
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50735.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-50735
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9daf27e62852d68c6ffc2c21090238ea51bb0a7fFixed69346de0eb956fb92949b9473de4647d9c34a54fFixed58fdd84a89b121b761dbfb8a196356e007376ca4Fixedf5ac749a0b21beee55d87d0b05de36976b22dff9Fixedbd5dac7ced5a7c9faa4dc468ac9560c3256df845