CVE-2022-50164 in Linux
Summary
by MITRE • 06/18/2025
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
After successfull station association, if station queues are disabled for some reason, the related lists are not emptied. So if some new element is added to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old one and produce a BUG like this:
[ 46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388).
[ 46.535283] ------------[ cut here ]------------
[ 46.535284] kernel BUG at lib/list_debug.c:26!
[ 46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[ 46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1
[ 46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN , BIOS A07 08/24/2012
[ 46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f
[ 46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1
[ 46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286
[ 46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000
[ 46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff
[ 46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666
[ 46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388
[ 46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0
[ 46.666108] FS: 00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000
[ 46.674331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0
[ 46.687422] Call Trace:
[ 46.689906] <TASK>
[ 46.691950] iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm]
[ 46.697601] ieee80211_queue_skb+0x4b3/0x720 [mac80211]
[ 46.702973] ? sta_info_get+0x46/0x60 [mac80211]
[ 46.707703] ieee80211_tx+0xad/0x110 [mac80211]
[ 46.712355] __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211]
...
In order to avoid this problem, we must also remove the related lists when station queues are disabled.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 12/01/2025
This vulnerability exists within the linux kernel's iwlwifi wireless driver component, specifically in the iwl_mvm_mac_wake_tx_queue function where a double list_add operation can occur due to improper list management during wifi station queue operations. The flaw manifests when a station successfully associates with a wireless network but subsequently has its transmission queues disabled for some reason, creating a state where the associated lists are not properly cleared. When new elements are subsequently added to these lists, they can create corrupted list structures that trigger kernel panics and system crashes. The issue stems from a fundamental failure in the driver's state management where disabled queue lists retain stale references that conflict with newly inserted elements, leading to memory corruption in the kernel's list data structures. This type of vulnerability directly impacts the integrity of kernel memory management and can result in complete system instability.
The technical implementation of this vulnerability involves the manipulation of linked list structures within the kernel's memory space, specifically the list_debug.c module which enforces list integrity checks. When the iwl_mvm_mac_wake_tx_queue function attempts to add elements to lists that were not properly cleared after queue disablement, the kernel's list validation routines detect inconsistencies in the prev->next pointer relationships, causing immediate kernel BUG detection. The error message shows a corrupted list_add operation where the previous node's next pointer references an invalid address instead of the expected next element, triggering the kernel's list corruption detection mechanism. This particular vulnerability is classified under the common weakness enumeration CWE-119 as it represents an improper restriction of operations within a memory buffer, specifically affecting kernel memory structures. The attack surface is limited to systems running affected linux kernel versions with iwlwifi wireless drivers, particularly those using intel wireless network adapters.
The operational impact of this vulnerability is significant as it can cause complete system crashes and reboots during normal wireless network operations, particularly during station association and queue management transitions. Any wireless client attempting to connect to a network where transmission queues are temporarily disabled can trigger this condition, making it a persistent threat to wireless network stability. The vulnerability affects both client and access point modes of wireless operation, potentially disrupting network connectivity for all devices using the affected driver. System administrators and users experience immediate service disruption, with no graceful degradation possible since the kernel panic occurs at the memory management level. This vulnerability can be exploited by malicious actors to perform denial of service attacks against wireless networks by repeatedly triggering the queue disable/enable cycle, leading to repeated system crashes and network outages.
Mitigation strategies for this vulnerability require immediate kernel updates to versions containing the fix for CVE-2022-50164, which properly ensures that all related lists are emptied when station queues are disabled. System administrators should prioritize patching affected systems and monitoring for any signs of kernel crashes or instability during wireless operations. The fix implemented addresses the root cause by ensuring proper list cleanup during queue disable operations, preventing the accumulation of stale references that could later conflict with new elements. Network security teams should also implement monitoring for unusual wireless network behavior that might indicate exploitation attempts, particularly around station association and queue management events. Additionally, organizations should consider implementing network segmentation and redundant wireless infrastructure to minimize the impact of potential exploitation attempts, while maintaining regular kernel update schedules to prevent similar vulnerabilities from accumulating in their wireless network infrastructure. This vulnerability demonstrates the critical importance of proper resource management in kernel space and the potential for seemingly minor state management flaws to result in complete system failures.