CVE-2022-50863

What it actually does

Failure to release an unused socket buffer (skb) in the rtw89 Wi-Fi driver under power-saving conditions results in a memory leak that can lead to gradual kernel memory exhaustion.

Why it matters to the business

Over time, systems may experience degraded performance, increased memory pressure, or crashes that interrupt wireless connectivity and require reboots, raising operational costs especially in environments with many affected devices.

How an attack unfolds

An attacker with the ability to trigger repeated power-save state transitions on an affected wireless interface can cause the driver to allocate skbs without freeing them, slowly consuming kernel memory until the system becomes unstable or unresponsive.

How to fix it

Update the Linux kernel to a version containing commit d4b4f6ff8ff1b87d25977423cf38fb61744d0023 or later that frees the unused skb in the rtw89 power-save path.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary; monitor kernel memory usage and skb allocation counters under power-save workloads before and after the update.

Typical attack path

1. Identify a target running an unpatched Linux kernel with the rtw89 driver.
2. Force the wireless interface into power-saving mode through repeated association or traffic patterns.
3. Repeatedly trigger skb allocation paths that are not freed.
4. Monitor for memory pressure or kernel warnings indicating exhaustion.
5. Continue until the system crashes or becomes unusable.

How to detect it

Review kernel logs for repeated rtw89 warnings or memory allocation failures; track skb allocation versus free counts during power-save transitions; look for gradual increases in kernel slab memory usage correlated with wireless activity.

What your security team should do

• Apply the kernel update containing the referenced fix as soon as possible on all systems using the rtw89 driver.
• Prioritize systems that frequently enter power-saving mode or run long-lived wireless workloads.
• Add kernel memory and skb leak monitoring to existing telemetry until patches are deployed.
• Review wireless driver usage and consider disabling power-save features temporarily if updates cannot be applied quickly.