CVE-2022-50172 in Linux
Summary
by MITRE • 06/18/2025
In the Linux kernel, the following vulnerability has been resolved:
mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg
Free the skb if mt76u_bulk_msg fails in __mt76x02u_mcu_send_msg routine.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/01/2025
The vulnerability CVE-2022-50172 represents a memory leak issue within the Linux kernel's mt76 wireless driver subsystem, specifically affecting the mt76x02u module used for MediaTek MT76x02 USB wireless adapters. This flaw exists in the __mt76x02u_mcu_send_msg routine where proper resource cleanup is not performed when certain error conditions occur during message transmission to the wireless device's microcontroller unit. The issue manifests when the mt76u_bulk_msg function fails, leaving allocated socket buffer (skb) memory unreleased, creating a persistent memory leak that can accumulate over time and potentially impact system stability.
The technical implementation of this vulnerability stems from inadequate error handling within the wireless driver's communication pathway. When mt76u_bulk_msg encounters a failure condition during data transmission to the wireless hardware, the calling function __mt76x02u_mcu_send_msg does not properly free the previously allocated socket buffer memory. This memory leak occurs because the driver fails to check the return status of mt76u_bulk_msg and execute the necessary cleanup routine to release the skb memory allocation. The flaw directly relates to CWE-401, which addresses improper resource management and memory leaks in software applications, particularly in kernel space where such issues can have cascading effects on system performance and stability.
The operational impact of this vulnerability extends beyond simple memory consumption, as persistent memory leaks can lead to progressive system degradation and potential denial of service conditions. In environments where wireless connectivity is heavily utilized, such as in embedded systems or network infrastructure devices, the accumulation of leaked memory can eventually exhaust available system resources, causing the wireless subsystem to become unresponsive or requiring system reboot to restore functionality. This vulnerability affects Linux kernel versions that include the mt76 wireless driver module and specifically targets devices using MediaTek MT76x02 USB wireless chipsets, making it particularly relevant for IoT devices, routers, and embedded systems that rely on this hardware platform.
Mitigation strategies for CVE-2022-50172 focus on implementing proper error handling and resource management within the affected driver code. The fix requires modifying the __mt76x02u_mcu_send_msg routine to include conditional checks for mt76u_bulk_msg return values and ensure that all allocated socket buffers are properly freed regardless of the function's success or failure status. System administrators should prioritize applying kernel updates that contain the patched driver code, particularly in environments where wireless connectivity is critical. Additionally, monitoring system memory usage and implementing automated alerting for unusual memory consumption patterns can help detect potential exploitation of this vulnerability. The fix aligns with ATT&CK technique T1070.004, which involves the use of system resource manipulation, and represents a fundamental requirement for maintaining kernel stability and preventing resource exhaustion attacks that could compromise system availability.