CVE-2022-50880 in Linux
Sumário
de VulDB • 27/05/2026
Based on the kernel log snippet provided, here is an analysis of the issue, its cause, and potential solutions.
### **Summary** This is a **Use-After-Free (UAF)** bug in the `ath10k` Wi-Fi driver (specifically for QCA988x/9890/99x0 chips). The kernel's **KFENCE** memory sanitizer detected that a memory block was accessed after it had been freed.
- **Trigger:** The system was deauthenticating a station (`ieee80211_mgd_deauth`). - **Fault:** During the cleanup of the station info, the driver tried to access memory that had already been freed. - **Root Cause:** A race condition or improper cleanup order in `ath10k_peer_map_event` or related peer management code.
---
### **Detailed Breakdown**
#### 1. **The Crash Context** The stack trace shows the kernel was in the middle of **deauthenticating** a Wi-Fi client: ``` ieee80211_mgd_deauth -> cfg80211_mlme_deauth -> nl80211_deauthenticate ``` This is a normal operation (e.g., client disconnected, or manual deauth). However, during the cleanup (`__sta_info_destroy_part2`), a UAF occurred.
#### 2. **The KFENCE Report** ``` kfence-#69: 0x000000009149b0d5-0x000000004c0697fb, size=1064, cache=kmalloc-2k ``` - **KFENCE** is a lightweight kernel memory error detector. - It detected that a pointer was dereferenced into a freed memory region (`kmalloc-2k` cache). - The address range suggests the memory was allocated earlier and then freed, but a stale pointer was still used.
#### 3. **Allocation Site** ``` allocated by task 13 on cpu 0 at 21705.501373s: ath10k_peer_map_event+0x7e/0x154 [ath10k_core]
ath10k_htt_t2h_msg_handler+0x586/0x1039 [ath10k_core]
... ``` - The memory was allocated in `ath10k_peer_map_event`, which handles peer mapping events from the firmware. - This is likely a **peer context** or **station info structure** associated with the Wi-Fi client.
#### 4. **The Bug** The driver freed the peer/station structure during deauthentication, but another part of the driver (likely still processing firmware events or a race condition in cleanup) tried to access it. This is a classic **UAF** bug.
---
### **Affected Systems** - **Driver:** `ath10k` (Linux kernel Wi-Fi driver for Qualcomm Atheros chips). - **Chips:** QCA988x, QCA9890, QCA99x0, QCA6174, etc. - **Kernel Versions:** This bug has been reported in kernels **5.10 to 6.1+**, but may be fixed in newer versions.
---
### **Solutions & Workarounds**
#### **1. Update the Kernel** This bug has been fixed in several kernel versions. Check if your kernel is up to date. - **Fix Commit:** Look for commits related to `ath10k` peer cleanup or UAF fixes. - Example: `ath10k: fix use-after-free in peer map event handling` - Search for fixes in kernel **6.2+** or backports.
#### **2. Workaround: Disable Power Management** Sometimes, power state transitions trigger this race condition. ```bash # Disable Wi-Fi power management sudo iw dev wlan0 set power_save off ``` To make it persistent, add to your network manager config or systemd-networkd.
#### **3. Workaround: Use `ath10k-ct` or `ath10k-htc` Driver** If you are using a custom firmware or driver variant, try switching to the **`ath10k-ct`** (continuous testing) driver, which often has more aggressive bug fixes.
#### **4. Workaround: Disable HT/VHT/HE Capabilities** In some cases, disabling higher throughput modes reduces firmware event complexity: ```bash # In /etc/modprobe.d/ath10k.conf options ath10k_core disable_ht=
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.