Cloudanix VulnDB

CVE-2022-50871

None

CVSS

—

EPSS

0.2%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing safeguard in the Linux kernel's wireless code can cause crashes or memory problems on affected devices until the software is updated.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing null terminator in qmi_msg_handler array allows infinite loop during handler lookup for unknown message IDs, resulting in out-of-bounds access inside qmi_invoke_handler().

Why it matters to the business

Unpatched Linux systems using ath11k WiFi may experience kernel instability, crashes, or memory corruption that disrupts wireless networking and overall system availability.

How an attack unfolds

An attacker sends a crafted QMI message containing a message ID absent from the handlers array; the missing terminator causes the lookup loop to run past array bounds and trigger out-of-bounds memory access.

How to fix it

Apply the upstream fix by updating the Linux kernel to commit d5d71de448f36e34592f7c81b5e300d3e8dbb735 or later stable release containing the corrected qmi_msg_handler initialization.

How to confirm the fix worked

Verify the kernel source contains commit d5d71de448f36e34592f7c81b5e300d3e8dbb735 and confirm the qmi_msg_handler array is explicitly null-terminated.

Typical attack path

  1. Identify target running vulnerable ath11k driver in Linux kernel
  2. Craft QMI message with message ID not present in handlers array
  3. Transmit message to trigger handler lookup
  4. Induce infinite loop and subsequent out-of-bounds access

How to detect it

Review kernel logs for unexpected ath11k or QMI handler errors and monitor for system crashes or oops reports around wireless message processing; no public exploitation artifacts are known.

What your security team should do

  • Prioritize kernel update to the fixed commit on all systems using ath11k WiFi
  • Monitor vendor advisories for distribution-specific backports
  • Test the updated kernel in a staging environment before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix qmi_msg_handler data structure initialization qmi_msg_handler is required to be null terminated by QMI module. There might be a case where a handler for a msg id is not present in the handlers array which can lead to infinite loop while searching the handler and therefore out of bound access in qmi_invoke_handler(). Hence update the initialization in qmi_msg_handler data structure. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 6.0.16
Linux Kernel 5.6.0 6.0.16

Related vulnerabilities