CVE-2022-50735 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: do not run mt76u_status_worker if the device is not running
Fix the following NULL pointer dereference avoiding to run mt76u_status_worker thread if the device is not running yet.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 98 Comm: kworker/u2:2 Not tainted 5.14.0+ #78 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: mt76 mt76u_tx_status_data RIP: 0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: mt76x02_send_tx_status+0x1d2/0xeb0 mt76x02_tx_status_data+0x8e/0xd0 mt76u_tx_status_data+0xe1/0x240 process_one_work+0x92b/0x1460 worker_thread+0x95/0xe00 kthread+0x3a1/0x480 ret_from_fork+0x1f/0x30 Modules linked in: --[ end trace 8df5d20fc5040f65 ]--
RIP: 0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554
Moreover move stat_work schedule out of the for loop.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability described in CVE-2022-50735 affects the Linux kernel's mt76 wireless driver module, specifically within the mt76u_status_worker function. This issue represents a null pointer dereference that occurs when the wireless device is not yet fully initialized or operational. The flaw manifests during the transmission status processing workflow where the kernel attempts to access memory through a null pointer reference, leading to a kernel oops and potential system instability. The kernel address sanitizer (KASAN) output indicates the fault occurred in the mt76x02_mac_fill_tx_status function at address range 0x0000000000000000-0x0000000000000007, suggesting that a pointer expected to contain valid memory address information was instead null, causing the system to crash.
The technical root cause stems from improper device state validation within the wireless driver's workqueue processing mechanism. When the mt76u_tx_status_data function is invoked, it schedules the mt76u_status_worker thread to handle transmission status updates without first verifying whether the underlying wireless device is in a running state. This race condition allows the worker thread to execute against uninitialized or improperly configured device structures, leading to memory access violations. The call trace demonstrates the execution path through mt76x02_send_tx_status, mt76x02_tx_status_data, and mt76u_tx_status_data functions before reaching the critical null pointer dereference point. According to CWE-476, this vulnerability maps directly to a null pointer dereference scenario where the code fails to validate pointer references before use.
The operational impact of this vulnerability extends beyond simple system crashes, potentially enabling denial of service conditions that could affect wireless connectivity for extended periods. Attackers could exploit this weakness to cause system instability or force kernel panics, particularly in environments where wireless devices are actively being initialized or reconfigured. The vulnerability affects systems using MediaTek mt76 wireless drivers, which are commonly found in various router and embedded device implementations. This issue particularly impacts systems running kernel versions 5.14.0 and later where the affected driver modules are present, potentially affecting enterprise wireless infrastructure and consumer devices alike.
The fix implemented addresses the core issue by adding proper device state validation before executing the mt76u_status_worker thread. The patch ensures that the worker function only executes when the device is confirmed to be in a running operational state, preventing execution against uninitialized structures. Additionally, the fix restructures the work scheduling mechanism by moving stat_work scheduling outside of any for loops, eliminating potential race conditions and ensuring proper execution order. This remediation aligns with ATT&CK technique T1489, which covers system shutdown and service interruption, as the vulnerability could be exploited to disrupt wireless services. The solution follows security best practices for device driver development, ensuring proper state management and resource validation before memory access operations. Organizations should apply the kernel patch immediately to prevent exploitation and maintain system stability in wireless network environments.