{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50164", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.425Z", "datePublished": "2025-06-18T11:03:18.943Z", "dateUpdated": "2026-08-05T08:57:34.894Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:34.894Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue\n\nAfter successfull station association, if station queues are disabled for\nsome reason, the related lists are not emptied. So if some new element is\nadded to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old\none and produce a BUG like this:\n\n[ 46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388).\n[ 46.535283] ------------[ cut here ]------------\n[ 46.535284] kernel BUG at lib/list_debug.c:26!\n[ 46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI\n[ 46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1\n[ 46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN , BIOS A07 08/24/2012\n[ 46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f\n[ 46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1\n[ 46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286\n[ 46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000\n[ 46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff\n[ 46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666\n[ 46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388\n[ 46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0\n[ 46.666108] FS: 00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000\n[ 46.674331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0\n[ 46.687422] Call Trace:\n[ 46.689906] \n[ 46.691950] iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm]\n[ 46.697601] ieee80211_queue_skb+0x4b3/0x720 [mac80211]\n[ 46.702973] ? sta_info_get+0x46/0x60 [mac80211]\n[ 46.707703] ieee80211_tx+0xad/0x110 [mac80211]\n[ 46.712355] __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211]\n...\n\nIn order to avoid this problem, we must also remove the related lists when\nstation queues are disabled." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The bug is in iwlwifi station TXQ lifecycle reached when a WiFi peer associates/disconnects and elicits TX (SoftAP client or association with an AP on the same RF segment), so exploitation is from an adjacent wireless attacker rather than a local account or remote internet path.\nAC:L - An adjacent attacker can reliably drive association, traffic, and station removal that hit disable_sta_queues then wake_tx_queue; Red Hat reproduced the failure, and the vulnerable list_add path had no lock, so success does not depend on conditions outside attacker influence.\nPR:N - No privileges on the victim OS are required—only the ability to participate as a WiFi peer (e.g., connect to a hotspot or complete association), which does not grant local user rights.\nUI:N - No victim user action is required beyond the device already operating WiFi/AP mode; the attacker triggers the path through peer association and traffic alone.\nS:U - Impact remains within the local kernel’s authority (crash or memory corruption leading to privilege escalation on the same host), with no VM/IOMMU/sandbox boundary crossed.\nC:H - Double list_add corrupts kernel linked-list metadata; without DEBUG_LIST this is exploitable memory corruption that can be leveraged for arbitrary read primitives, so confidentiality impact is High.\nI:H - Kernel list corruption yields classic write-what-where primitives via subsequent list operations and can be used for control-flow hijacking, so integrity impact is High.\nA:H - The observed failure is a kernel BUG in list_debug (and list corruption can oops/panic even without BUG_ON_DATA_CORRUPTION), so availability impact is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/mvm/sta.c" ], "versions": [ { "version": "cfbc6c4c5b91c7725ef14465b98ac347d31f2334", "lessThan": "5cca5f714fe6cedd2df9d8451ad8df21e6464f62", "status": "affected", "versionType": "git" }, { "version": "cfbc6c4c5b91c7725ef14465b98ac347d31f2334", "lessThan": "38d71acc15a2e72806b516380af0adb3830d4639", "status": "affected", "versionType": "git" }, { "version": "cfbc6c4c5b91c7725ef14465b98ac347d31f2334", "lessThan": "4a40af2b0b9517fca7ae2a030c9c0a16836303c0", "status": "affected", "versionType": "git" }, { "version": "cfbc6c4c5b91c7725ef14465b98ac347d31f2334", "lessThan": "ff068c25bf90d26f0aee1751553f18076b797e8d", "status": "affected", "versionType": "git" }, { "version": "cfbc6c4c5b91c7725ef14465b98ac347d31f2334", "lessThan": "182d3c1385f44ba7c508bf5b1292a7fe96ad4e9e", "status": "affected", "versionType": "git" }, { "version": "cfbc6c4c5b91c7725ef14465b98ac347d31f2334", "lessThan": "14a3aacf517a9de725dd3219dbbcf741e31763c4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/mvm/sta.c" ], "versions": [ { "version": "5.1", "status": "affected" }, { "version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.211", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.137", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.61", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18.18", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.2", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.4.211" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.137" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.61" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.18.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.19.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5cca5f714fe6cedd2df9d8451ad8df21e6464f62" }, { "url": "https://git.kernel.org/stable/c/38d71acc15a2e72806b516380af0adb3830d4639" }, { "url": "https://git.kernel.org/stable/c/4a40af2b0b9517fca7ae2a030c9c0a16836303c0" }, { "url": "https://git.kernel.org/stable/c/ff068c25bf90d26f0aee1751553f18076b797e8d" }, { "url": "https://git.kernel.org/stable/c/182d3c1385f44ba7c508bf5b1292a7fe96ad4e9e" }, { "url": "https://git.kernel.org/stable/c/14a3aacf517a9de725dd3219dbbcf741e31763c4" } ], "title": "wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue", "x_generator": { "engine": "bippy-1.2.0" } } } }