{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50700", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:53:15.517Z", "datePublished": "2025-12-24T10:55:16.257Z", "dateUpdated": "2026-08-05T08:59:25.705Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:59:25.705Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath10k: Delay the unmapping of the buffer\n\nOn WCN3990, we are seeing a rare scenario where copy engine hardware is\nsending a copy complete interrupt to the host driver while still\nprocessing the buffer that the driver has sent, this is leading into an\nSMMU fault triggering kernel panic. This is happening on copy engine\nchannel 3 (CE3) where the driver normally enqueues WMI commands to the\nfirmware. Upon receiving a copy complete interrupt, host driver will\nimmediately unmap and frees the buffer presuming that hardware has\nprocessed the buffer. In the issue case, upon receiving copy complete\ninterrupt, host driver will unmap and free the buffer but since hardware\nis still accessing the buffer (which in this case got unmapped in\nparallel), SMMU hardware will trigger an SMMU fault resulting in a\nkernel panic.\n\nIn order to avoid this, as a work around, add a delay before unmapping\nthe copy engine source DMA buffer. This is conditionally done for\nWCN3990 and only for the CE3 channel where issue is seen.\n\nBelow is the crash signature:\n\nwifi smmu error: kernel: [ 10.120965] arm-smmu 15000000.iommu: Unhandled\ncontext fault: fsr=0x402, iova=0x7fdfd8ac0,\nfsynr=0x500003,cbfrsynra=0xc1, cb=6 arm-smmu 15000000.iommu: Unhandled\ncontext fault:fsr=0x402, iova=0x7fe06fdc0, fsynr=0x710003,\ncbfrsynra=0xc1, cb=6 qcom-q6v5-mss 4080000.remoteproc: fatal error\nreceived: err_qdi.c:1040:EF:wlan_process:0x1:WLAN RT:0x2091:\ncmnos_thread.c:3998:Asserted in copy_engine.c:AXI_ERROR_DETECTED:2149\nremoteproc remoteproc0: crash detected in\n4080000.remoteproc: type fatal error <3> remoteproc remoteproc0:\nhandling crash #1 in 4080000.remoteproc\n\npc : __arm_lpae_unmap+0x500/0x514\nlr : __arm_lpae_unmap+0x4bc/0x514\nsp : ffffffc011ffb530\nx29: ffffffc011ffb590 x28: 0000000000000000\nx27: 0000000000000000 x26: 0000000000000004\nx25: 0000000000000003 x24: ffffffc011ffb890\nx23: ffffffa762ef9be0 x22: ffffffa77244ef00\nx21: 0000000000000009 x20: 00000007fff7c000\nx19: 0000000000000003 x18: 0000000000000000\nx17: 0000000000000004 x16: ffffffd7a357d9f0\nx15: 0000000000000000 x14: 00fd5d4fa7ffffff\nx13: 000000000000000e x12: 0000000000000000\nx11: 00000000ffffffff x10: 00000000fffffe00\nx9 : 000000000000017c x8 : 000000000000000c\nx7 : 0000000000000000 x6 : ffffffa762ef9000\nx5 : 0000000000000003 x4 : 0000000000000004\nx3 : 0000000000001000 x2 : 00000007fff7c000\nx1 : ffffffc011ffb890 x0 : 0000000000000000 Call trace:\n__arm_lpae_unmap+0x500/0x514\n__arm_lpae_unmap+0x4bc/0x514\n__arm_lpae_unmap+0x4bc/0x514\narm_lpae_unmap_pages+0x78/0xa4\narm_smmu_unmap_pages+0x78/0x104\n__iommu_unmap+0xc8/0x1e4\niommu_unmap_fast+0x38/0x48\n__iommu_dma_unmap+0x84/0x104\niommu_dma_free+0x34/0x50\ndma_free_attrs+0xa4/0xd0\nath10k_htt_rx_free+0xc4/0xf4 [ath10k_core] ath10k_core_stop+0x64/0x7c\n[ath10k_core]\nath10k_halt+0x11c/0x180 [ath10k_core]\nath10k_stop+0x54/0x94 [ath10k_core]\ndrv_stop+0x48/0x1c8 [mac80211]\nieee80211_do_open+0x638/0x77c [mac80211] ieee80211_open+0x48/0x5c\n[mac80211]\n__dev_open+0xb4/0x174\n__dev_change_flags+0xc4/0x1dc\ndev_change_flags+0x3c/0x7c\ndevinet_ioctl+0x2b4/0x580\ninet_ioctl+0xb0/0x1b4\nsock_do_ioctl+0x4c/0x16c\ncompat_ifreq_ioctl+0x1cc/0x35c\ncompat_sock_ioctl+0x110/0x2ac\n__arm64_compat_sys_ioctl+0xf4/0x3e0\nel0_svc_common+0xb4/0x17c\nel0_svc_compat_handler+0x2c/0x58\nel0_svc_compat+0x8/0x2c\n\nTested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The bug is in ath10k CE3 host→target WMI TX completion unmap on WCN3990; an adjacent WiFi attacker can force that path via deauth/disassoc or malicious-AP association churn (mac80211 → ath10k_sta_state → WMI peer/vdev commands on CE3), matching Adjacent WiFi reachability.\nAC:H - The failure requires the copy-engine hardware to raise a copy-complete interrupt while DMA of the WMI buffer is still in flight—a rare hardware timing condition the attacker cannot induce or control, only hope to encounter while generating WMI traffic.\nPR:N - An adjacent RF-segment attacker needs no account or capabilities on the victim OS; forged or AP-originated management frames drive mac80211 teardown into WMI TX on CE3 without CAP_NET_ADMIN or local credentials.\nUI:N - Once the WCN3990 interface is associated/operating, the attacker can unilaterally force disconnect/reconnect and WMI completions; no additional victim action is required.\nS:U - The premature dma_unmap and resulting SMMU fault/panic affect host kernel/driver state within the same OS security authority; an SMMU fault is the IOMMU enforcing a bad DMA access, not an IOMMU/VM boundary bypass.\nC:H - This is a DMA use-after-unmap on the CE3 source buffer (unmap then free while the engine may still read host memory); per UAF guidance that enables disclosure of reallocated kernel memory contents through the lingering device DMA read.\nI:H - DMA use-after-unmap of a freed WMI TX skb is a memory-lifetime violation; with IOVA reuse the still-active copy engine can interact with remapped memory, and UAF guidance treats such corruption as enabling integrity/control-flow impact (higher severity chosen under uncertainty).\nA:H - The documented result is an arm-smmu unhandled context fault cascading into remoteproc/WLAN firmware fatal error and kernel panic, which is Availability High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath10k/core.c", "drivers/net/wireless/ath/ath10k/htc.c", "drivers/net/wireless/ath/ath10k/hw.h" ], "versions": [ { "version": "d390509bdf501c9c8c6e61248e4bc9314c86d854", "lessThan": "c4bedc3cda09d896c92adcdb6b62aa93b0c47a8a", "status": "affected", "versionType": "git" }, { "version": "d390509bdf501c9c8c6e61248e4bc9314c86d854", "lessThan": "79a124b588aadb5a22695542778de14366ff3219", "status": "affected", "versionType": "git" }, { "version": "d390509bdf501c9c8c6e61248e4bc9314c86d854", "lessThan": "acd4324e5f1f11351630234297f95076f0ac9a2f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ath/ath10k/core.c", "drivers/net/wireless/ath/ath10k/htc.c", "drivers/net/wireless/ath/ath10k/hw.h" ], "versions": [ { "version": "4.18", "status": "affected" }, { "version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.16", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.2", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.0.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c4bedc3cda09d896c92adcdb6b62aa93b0c47a8a" }, { "url": "https://git.kernel.org/stable/c/79a124b588aadb5a22695542778de14366ff3219" }, { "url": "https://git.kernel.org/stable/c/acd4324e5f1f11351630234297f95076f0ac9a2f" } ], "title": "wifi: ath10k: Delay the unmapping of the buffer", "x_generator": { "engine": "bippy-1.2.0" } } } }