CVE-2022-50187 [Medium] | Security Vulnerability in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: ath11k: fix netdev open race Make sure to allocate resources needed before registering the device. This specifically avoids having a racing open() trigger a BUG_ON() in mod_timer() when ath11k_mac_op_start() is called before the mon_reap_timer as been set up. I did not see this issue with next-20220310, but I hit it on every probe with next-20220511. Perhaps some timing changed in between. Here's the backtrace: [ 51.346947] kernel BUG at kernel/time/timer.c:990! [ 51.346958] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ... [ 51.578225] Call trace: [ 51.583293] __mod_timer+0x298/0x390 [ 51.589518] mod_timer+0x14/0x20 [ 51.595368] ath11k_mac_op_start+0x41c/0x4a0 [ath11k] [ 51.603165] drv_start+0x38/0x60 [mac80211] [ 51.610110] ieee80211_do_open+0x29c/0x7d0 [mac80211] [ 51.617945] ieee80211_open+0x60/0xb0 [mac80211] [ 51.625311] __dev_open+0x100/0x1c0 [ 51.631420] __dev_change_flags+0x194/0x210 [ 51.638214] dev_change_flags+0x24/0x70 [ 51.644646] do_setlink+0x228/0xdb0 [ 51.650723] __rtnl_newlink+0x460/0x830 [ 51.657162] rtnl_newlink+0x4c/0x80 [ 51.663229] rtnetlink_rcv_msg+0x124/0x390 [ 51.669917] netlink_rcv_skb+0x58/0x130 [ 51.676314] rtnetlink_rcv+0x18/0x30 [ 51.682460] netlink_unicast+0x250/0x310 [ 51.688960] netlink_sendmsg+0x19c/0x3e0 [ 51.695458] ____sys_sendmsg+0x220/0x290 [ 51.701938] ___sys_sendmsg+0x7c/0xc0 [ 51.708148] __sys_sendmsg+0x68/0xd0 [ 51.714254] __arm64_sys_sendmsg+0x28/0x40 [ 51.720900] invoke_syscall+0x48/0x120 Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2025-06-18	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2025-06-18

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.7	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.0	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.7

3.1

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.0

3.6

[email protected]

OS Trackers for CVE-2022-50187

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2022-50187 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2022-50187
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2022-50187
`suse`	medium	—	https://www.suse.com/security/cve/CVE-2022-50187/
`ubuntu`	medium	CVE-2022-50187 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1551 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1145, ignored 147, not-affected 144, released 114, needs-triage 1.	https://ubuntu.com/security/CVE-2022-50187

Affected software / configurations for CVE-2022-50187

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 5.6, < 5.10.137	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.11, < 5.15.61	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.16, < 5.18.18	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.19, < 5.19.2	cpe:2.3:o:linux:linux_kernel::::::::

References for CVE-2022-50187

URL	Tags
https://git.kernel.org/stable/c/307ce58270b3b50ca21cfcc910568429b06803f7	Patch
https://git.kernel.org/stable/c/a2c45f8c3d18269e641f0c7da2dde47ef8414034	Patch
https://git.kernel.org/stable/c/abb7dc8fbb27c15dcc927df56190f3c5ede58bd5	Patch
https://git.kernel.org/stable/c/d4ba1ff87b17e81686ada8f429300876f55f95ad	Patch
https://git.kernel.org/stable/c/eaff3946a86fc63280a30158a4ae1e141449817c	Patch

URL

CVE-2022-50187 | ath11k: fix netdev open race

Exploit prediction scoring system (EPSS) score for CVE-2022-50187

Common vulnerability scoring system (CVSS) metrics for CVE-2022-50187

Weakness enumeration for CVE-2022-50187

OS Trackers for CVE-2022-50187

Affected software / configurations for CVE-2022-50187

References for CVE-2022-50187