CVE-2022-50701

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-50701", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:53:15.517Z", "datePublished": "2025-12-24T10:55:17.090Z", "dateUpdated": "2026-10-15T21:41:23.201Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:59:26.804Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host\n\nSDIO may need addtional 511 bytes to align bus operation. If the tailroom\nof this skb is not big enough, we would access invalid memory region.\nFor low level operation, increase skb size to keep valid memory access in\nSDIO host.\n\nError message:\n[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0\n[69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451\n[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1\n[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300]\n[69.951] Call Trace:\n[69.951] <TASK>\n[69.952] dump_stack_lvl+0x49/0x63\n[69.952] print_report+0x171/0x4a8\n[69.952] kasan_report+0xb4/0x130\n[69.952] kasan_check_range+0x149/0x1e0\n[69.952] memcpy+0x24/0x70\n[69.952] sg_copy_buffer+0xe9/0x1a0\n[69.952] sg_copy_to_buffer+0x12/0x20\n[69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300]\n[69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300]\n[69.952] process_one_work+0x7ee/0x1320\n[69.952] worker_thread+0x53c/0x1240\n[69.952] kthread+0x2b8/0x370\n[69.952] ret_from_fork+0x1f/0x30\n[69.952] </TASK>\n\n[69.952] Allocated by task 854:\n[69.952] kasan_save_stack+0x26/0x50\n[69.952] kasan_set_track+0x25/0x30\n[69.952] kasan_save_alloc_info+0x1b/0x30\n[69.952] __kasan_kmalloc+0x87/0xa0\n[69.952] __kmalloc_node_track_caller+0x63/0x150\n[69.952] kmalloc_reserve+0x31/0xd0\n[69.952] __alloc_skb+0xfc/0x2b0\n[69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76]\n[69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76]\n[69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76]\n[69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib]\n[69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib]\n[69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common]\n[69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s]\n[69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common]\n[69.953] process_one_work+0x7ee/0x1320\n[69.953] worker_thread+0x53c/0x1240\n[69.953] kthread+0x2b8/0x370\n[69.953] ret_from_fork+0x1f/0x30\n[69.953] The buggy address belongs to the object at ffff88811c9ce800\n which belongs to the cache kmalloc-2k of size 2048\n[69.953] The buggy address is located 0 bytes to the right of\n 2048-byte region [ffff88811c9ce800, ffff88811c9cf000)\n\n[69.953] Memory state around the buggy address:\n[69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953] ^\n[69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in mt76s_tx_run_queue()'s pre-MCU firmware TX path (sdio_writesb of an undersized skb during mt7921_run_firmware), reached on local mt7921s SDIO probe/init or chip reset\u2014not via WiFi frame injection\u2014so Adjacent/Network do not apply.\nAC:L - Firmware scatter chunks up to 2048 bytes are sent while MCU_RUNNING is clear; __mt76s_xmit_queue() unconditionally roundups len to the 512-byte SDIO block size, so the OOB read is deterministic whenever tailroom is insufficient\u2014no race or attacker-uncontrollable layout is required.\nPR:L - The path runs during ordinary local driver bind/probe or reset recovery on systems with an mt7921s device; matching same-class mt7921 probe lifecycle scores, uncertainty between Low and High is resolved upward to Low.\nUI:N - Firmware download runs automatically from mt7921_init_work/mt7921s_mac_reset workqueues without a separate victim mount, open, or interactive step.\nS:U - The OOB access corrupts/reads host kernel slab within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - sdio_writesb reads up to 511 bytes past the skb allocation into adjacent kmalloc-2k slab (KASAN confirmed slab-out-of-bounds Read); per guidance, OOB reads not strictly bounded to a few bytes are Confidentiality High.\nI:N - KASAN and the fix show a pure out-of-bounds read into the SDIO write path; there is no OOB write, UAF, or other integrity/control-flow hijack primitive in the vulnerable code.\nA:H - Reading past the skb into unmapped or poisoned adjacent memory can oops/panic the kernel (as in the KASAN report via vub300/sg_copy_buffer), which is Availability High under kernel CVSS guidance."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/sdio_txrx.c"], "versions": [{"version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "lessThan": "8b5174a7f25d03df0ffa171ff86de383a89e8e89", "status": "affected", "versionType": "git"}, {"version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "lessThan": "0b358e36433d2c46a65488a146bf8b4623fc5bbb", "status": "affected", "versionType": "git"}, {"version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "lessThan": "aec4cf2ea0797e28f18f8dbe01943a56d987fe56", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/sdio_txrx.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.16", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2.3", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.2.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8b5174a7f25d03df0ffa171ff86de383a89e8e89"}, {"url": "https://git.kernel.org/stable/c/0b358e36433d2c46a65488a146bf8b4623fc5bbb"}, {"url": "https://git.kernel.org/stable/c/aec4cf2ea0797e28f18f8dbe01943a56d987fe56"}], "title": "wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50701", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:32:12.638456Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:23.201Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50701", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:32:12.638456Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:32:13.547Z"}}], "cna": {"title": "wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in mt76s_tx_run_queue()'s pre-MCU firmware TX path (sdio_writesb of an undersized skb during mt7921_run_firmware), reached on local mt7921s SDIO probe/init or chip reset\u2014not via WiFi frame injection\u2014so Adjacent/Network do not apply.\nAC:L - Firmware scatter chunks up to 2048 bytes are sent while MCU_RUNNING is clear; __mt76s_xmit_queue() unconditionally roundups len to the 512-byte SDIO block size, so the OOB read is deterministic whenever tailroom is insufficient\u2014no race or attacker-uncontrollable layout is required.\nPR:L - The path runs during ordinary local driver bind/probe or reset recovery on systems with an mt7921s device; matching same-class mt7921 probe lifecycle scores, uncertainty between Low and High is resolved upward to Low.\nUI:N - Firmware download runs automatically from mt7921_init_work/mt7921s_mac_reset workqueues without a separate victim mount, open, or interactive step.\nS:U - The OOB access corrupts/reads host kernel slab within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - sdio_writesb reads up to 511 bytes past the skb allocation into adjacent kmalloc-2k slab (KASAN confirmed slab-out-of-bounds Read); per guidance, OOB reads not strictly bounded to a few bytes are Confidentiality High.\nI:N - KASAN and the fix show a pure out-of-bounds read into the SDIO write path; there is no OOB write, UAF, or other integrity/control-flow hijack primitive in the vulnerable code.\nA:H - Reading past the skb into unmapped or poisoned adjacent memory can oops/panic the kernel (as in the KASAN report via vub300/sg_copy_buffer), which is Availability High under kernel CVSS guidance."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "lessThan": "8b5174a7f25d03df0ffa171ff86de383a89e8e89", "versionType": "git"}, {"status": "affected", "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "lessThan": "0b358e36433d2c46a65488a146bf8b4623fc5bbb", "versionType": "git"}, {"status": "affected", "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "lessThan": "aec4cf2ea0797e28f18f8dbe01943a56d987fe56", "versionType": "git"}], "programFiles": ["drivers/net/wireless/mediatek/mt76/sdio_txrx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.16", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.2.3", "versionType": "semver", "lessThanOrEqual": "6.2.*"}, {"status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/mediatek/mt76/sdio_txrx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8b5174a7f25d03df0ffa171ff86de383a89e8e89"}, {"url": "https://git.kernel.org/stable/c/0b358e36433d2c46a65488a146bf8b4623fc5bbb"}, {"url": "https://git.kernel.org/stable/c/aec4cf2ea0797e28f18f8dbe01943a56d987fe56"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host\n\nSDIO may need addtional 511 bytes to align bus operation. If the tailroom\nof this skb is not big enough, we would access invalid memory region.\nFor low level operation, increase skb size to keep valid memory access in\nSDIO host.\n\nError message:\n[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0\n[69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451\n[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1\n[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300]\n[69.951] Call Trace:\n[69.951] <TASK>\n[69.952] dump_stack_lvl+0x49/0x63\n[69.952] print_report+0x171/0x4a8\n[69.952] kasan_report+0xb4/0x130\n[69.952] kasan_check_range+0x149/0x1e0\n[69.952] memcpy+0x24/0x70\n[69.952] sg_copy_buffer+0xe9/0x1a0\n[69.952] sg_copy_to_buffer+0x12/0x20\n[69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300]\n[69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300]\n[69.952] process_one_work+0x7ee/0x1320\n[69.952] worker_thread+0x53c/0x1240\n[69.952] kthread+0x2b8/0x370\n[69.952] ret_from_fork+0x1f/0x30\n[69.952] </TASK>\n\n[69.952] Allocated by task 854:\n[69.952] kasan_save_stack+0x26/0x50\n[69.952] kasan_set_track+0x25/0x30\n[69.952] kasan_save_alloc_info+0x1b/0x30\n[69.952] __kasan_kmalloc+0x87/0xa0\n[69.952] __kmalloc_node_track_caller+0x63/0x150\n[69.952] kmalloc_reserve+0x31/0xd0\n[69.952] __alloc_skb+0xfc/0x2b0\n[69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76]\n[69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76]\n[69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76]\n[69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib]\n[69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib]\n[69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common]\n[69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s]\n[69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common]\n[69.953] process_one_work+0x7ee/0x1320\n[69.953] worker_thread+0x53c/0x1240\n[69.953] kthread+0x2b8/0x370\n[69.953] ret_from_fork+0x1f/0x30\n[69.953] The buggy address belongs to the object at ffff88811c9ce800\n which belongs to the cache kmalloc-2k of size 2048\n[69.953] The buggy address is located 0 bytes to the right of\n 2048-byte region [ffff88811c9ce800, ffff88811c9cf000)\n\n[69.953] Memory state around the buggy address:\n[69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953] ^\n[69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.16", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.2.3", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3", "versionStartIncluding": "5.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:59:26.804Z"}}}, "cveMetadata": {"cveId": "CVE-2022-50701", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:23.201Z", "dateReserved": "2025-12-24T10:53:15.517Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-24T10:55:17.090Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/mediatek/mt76/sdio_txrx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8b5174a7f25d03df0ffa171ff86de383a89e8e89", "status": "affected", "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "versionType": "git"}, {"lessThan": "0b358e36433d2c46a65488a146bf8b4623fc5bbb", "status": "affected", "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "versionType": "git"}, {"lessThan": "aec4cf2ea0797e28f18f8dbe01943a56d987fe56", "status": "affected", "version": "764dee47e2c1ed828c8a51cbf58f89b5e3ded11b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/mediatek/mt76/sdio_txrx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.16", "versionType": "semver"}, {"lessThanOrEqual": "6.2.*", "status": "unaffected", "version": "6.2.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host\n\nSDIO may need addtional 511 bytes to align bus operation. If the tailroom\nof this skb is not big enough, we would access invalid memory region.\nFor low level operation, increase skb size to keep valid memory access in\nSDIO host.\n\nError message:\n[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0\n[69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451\n[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1\n[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300]\n[69.951] Call Trace:\n[69.951] <TASK>\n[69.952] dump_stack_lvl+0x49/0x63\n[69.952] print_report+0x171/0x4a8\n[69.952] kasan_report+0xb4/0x130\n[69.952] kasan_check_range+0x149/0x1e0\n[69.952] memcpy+0x24/0x70\n[69.952] sg_copy_buffer+0xe9/0x1a0\n[69.952] sg_copy_to_buffer+0x12/0x20\n[69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300]\n[69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300]\n[69.952] process_one_work+0x7ee/0x1320\n[69.952] worker_thread+0x53c/0x1240\n[69.952] kthread+0x2b8/0x370\n[69.952] ret_from_fork+0x1f/0x30\n[69.952] </TASK>\n\n[69.952] Allocated by task 854:\n[69.952] kasan_save_stack+0x26/0x50\n[69.952] kasan_set_track+0x25/0x30\n[69.952] kasan_save_alloc_info+0x1b/0x30\n[69.952] __kasan_kmalloc+0x87/0xa0\n[69.952] __kmalloc_node_track_caller+0x63/0x150\n[69.952] kmalloc_reserve+0x31/0xd0\n[69.952] __alloc_skb+0xfc/0x2b0\n[69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76]\n[69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76]\n[69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76]\n[69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib]\n[69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib]\n[69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common]\n[69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s]\n[69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common]\n[69.953] process_one_work+0x7ee/0x1320\n[69.953] worker_thread+0x53c/0x1240\n[69.953] kthread+0x2b8/0x370\n[69.953] ret_from_fork+0x1f/0x30\n[69.953] The buggy address belongs to the object at ffff88811c9ce800\n which belongs to the cache kmalloc-2k of size 2048\n[69.953] The buggy address is located 0 bytes to the right of\n 2048-byte region [ffff88811c9ce800, ffff88811c9cf000)\n\n[69.953] Memory state around the buggy address:\n[69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953] ^\n[69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc"}, {"lang": "es", "value": "En el kernel de Linux, se ha corregido la siguiente vulnerabilidad:\\n\\nwifi: mt76: mt7921s: corregir acceso fuera de los l\u00edmites del slab en el host SDIO\\n\\nSDIO puede necesitar 511?bytes adicionales para alinear la operaci\u00f3n del bus. Si el espacio libre al final de este skb no es suficientemente grande, se acceder\u00eda a una regi\u00f3n de memoria no v\u00e1lida. Para la operaci\u00f3n de bajo nivel, se incrementa el tama\u00f1o del skb para mantener un acceso a memoria v\u00e1lido en el host SDIO.\\n\\nMensaje de error:\\n[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0\\n[69.951] Lectura de 64?bytes en la direcci\u00f3n ffff88811c9cf000 por la tarea kworker/u16:7/451\\n[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1\\n[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300]\\n[69.951] Traza de llamada:\\n[69.951] [TASK]\\n[69.952] dump_stack_lvl+0x49/0x63\\n[69.952] print_report+0x171/0x4a8\\n[69.952] kasan_report+0xb4/0x130\\n[69.952] kasan_check_range+0x149/0x1e0\\n[69.952] memcpy+0x24/0x70\\n[69.952] sg_copy_buffer+0xe9/0x1a0\\n[69.952] sg_copy_to_buffer+0x12/0x20\\n[69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300]\\n[69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300]\\n[69.952] process_one_work+0x7ee/0x1320\\n[69.952] worker_thread+0x53c/0x1240\\n[69.952] kthread+0x2b8/0x370\\n[69.952] ret_from_fork+0x1f/0x30\\n[69.952] [/TASK]\\n\\n[69.952] Asignado por la tarea 854:\\n[69.952] kasan_save_stack+0x26/0x50\\n[69.952] kasan_set_track+0x25/0x30\\n[69.952] kasan_save_alloc_info+0x1b/0x30\\n[69.952] __kasan_kmalloc+0x87/0xa0\\n[69.952] __kmalloc_node_track_caller+0x63/0x150\\n[69.952] kmalloc_reserve+0x31/0xd0\\n[69.952] __alloc_skb+0xfc/0x2b0\\n[69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76]\\n[69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76]\\n[69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76]\\n[69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib]\\n[69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib]\\n[69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common]\\n[69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s]\\n[69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common]\\n[69.953] process_one_work+0x7ee/0x1320\\n[69.953] worker_thread+0x53c/0x1240\\n[69.953] kthread+0x2b8/0x370\\n[69.953] ret_from_fork+0x1f/0x30\\n[69.953] La direcci\u00f3n defectuosa pertenece al objeto en ffff88811c9ce800, que forma parte del cach\u00e9 kmalloc-2k de tama\u00f1o 2048\\n[69.953] La direcci\u00f3n defectuosa se encuentra a 0?bytes a la derecha de la regi\u00f3n de 2048?bytes [ffff88811c9ce800, ffff88811c9cf000)\\n\\n[69.953] Estado de la memoria alrededor de la direcci\u00f3n defectuosa:\\n[69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n[69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n[69.953] ^\\n[69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\\n[69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc"}], "id": "CVE-2022-50701", "lastModified": "2026-11-10T12:10:00.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-50701", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:32:12.638456Z", "version": "2.0.3"}}]}, "published": "2025-12-24T11:15:50.260", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b358e36433d2c46a65488a146bf8b4623fc5bbb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b5174a7f25d03df0ffa171ff86de383a89e8e89"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aec4cf2ea0797e28f18f8dbe01943a56d987fe56"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host", "id": "2424982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424982"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host\nSDIO may need addtional 511 bytes to align bus operation. If the tailroom\nof this skb is not big enough, we would access invalid memory region.\nFor low level operation, increase skb size to keep valid memory access in\nSDIO host.\nError message:\n[69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0\n[69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451\n[69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1\n[69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300]\n[69.951] Call Trace:\n[69.951] <TASK>\n[69.952] dump_stack_lvl+0x49/0x63\n[69.952] print_report+0x171/0x4a8\n[69.952] kasan_report+0xb4/0x130\n[69.952] kasan_check_range+0x149/0x1e0\n[69.952] memcpy+0x24/0x70\n[69.952] sg_copy_buffer+0xe9/0x1a0\n[69.952] sg_copy_to_buffer+0x12/0x20\n[69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300]\n[69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300]\n[69.952] process_one_work+0x7ee/0x1320\n[69.952] worker_thread+0x53c/0x1240\n[69.952] kthread+0x2b8/0x370\n[69.952] ret_from_fork+0x1f/0x30\n[69.952] </TASK>\n[69.952] Allocated by task 854:\n[69.952] kasan_save_stack+0x26/0x50\n[69.952] kasan_set_track+0x25/0x30\n[69.952] kasan_save_alloc_info+0x1b/0x30\n[69.952] __kasan_kmalloc+0x87/0xa0\n[69.952] __kmalloc_node_track_caller+0x63/0x150\n[69.952] kmalloc_reserve+0x31/0xd0\n[69.952] __alloc_skb+0xfc/0x2b0\n[69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76]\n[69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76]\n[69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76]\n[69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib]\n[69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib]\n[69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common]\n[69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s]\n[69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common]\n[69.953] process_one_work+0x7ee/0x1320\n[69.953] worker_thread+0x53c/0x1240\n[69.953] kthread+0x2b8/0x370\n[69.953] ret_from_fork+0x1f/0x30\n[69.953] The buggy address belongs to the object at ffff88811c9ce800\nwhich belongs to the cache kmalloc-2k of size 2048\n[69.953] The buggy address is located 0 bytes to the right of\n2048-byte region [ffff88811c9ce800, ffff88811c9cf000)\n[69.953] Memory state around the buggy address:\n[69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953] ^\n[69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc"], "name": "CVE-2022-50701", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-50701\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-50701\nhttps://lore.kernel.org/linux-cve-announce/2025122418-CVE-2022-50701-32f6@gregkh/T"], "threat_severity": "Moderate"}

{}