{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-50178 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-50178 is a medium-severity denial of service vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-50178 and fix it if it is affected.\n\nWhat it is: CVE-2022-50178 is a medium-severity denial of service vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-50178 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-50178/ (Markdown: https://insights.sbomify.com/CVE-2022-50178/index.md)","id":"CVE-2022-50178","markdown":"https://insights.sbomify.com/CVE-2022-50178/index.md","name":"CVE-2022-50178","record":{"aliases":["DEBIAN-CVE-2022-50178","GHSA-3wj6-j9c9-3mmg","ROOT-OS-UBUNTU-2204-CVE-2022-50178","UBUNTU-CVE-2022-50178"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel WiFi driver","requires_auth":"low_privilege","summary":"A divide-by-zero error in the rtw89 WiFi driver causes a kernel crash during RF calibration, leading to a denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-369","name":"Divide By Zero"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: 8852a: rfk: fix div 0 exception\n\nThe DPK is a kind of RF calibration whose algorithm is to fine tune\nparameters and calibrate, and check the result. If the result isn't good\nenough, it could adjust parameters and try again.\n\nThis issue is to read and show the result, but it could be a negative\ncalibration result that causes divisor 0 and core dump. So, fix it by\nphy_div() that does division only if divisor isn't zero; otherwise,\nzero is adopted.\n\n  divide error: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 PID: 728 Comm: wpa_supplicant Not tainted 5.10.114-16019-g462a1661811a #1 \u003cHASH:d024 28\u003e\n  RIP: 0010:rtw8852a_dpk+0x14ae/0x288f [rtw89_core]\n  RSP: 0018:ffffa9bb412a7520 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 00000000000180fc RDI: ffffa141d01023c0\n  RBP: ffffa9bb412a76a0 R08: 0000000000001319 R09: 00000000ffffff92\n  R10: ffffffffc0292de3 R11: ffffffffc00d2f51 R12: 0000000000000000\n  R13: ffffa141d01023c0 R14: ffffffffc0290250 R15: ffffa141d0102638\n  FS:  00007fa99f5c2740(0000) GS:ffffa142e5e80000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000013e8e010 CR3: 0000000110d2c000 CR4: 0000000000750ee0\n  PKRU: 55555554\n  Call Trace:\n   rtw89_core_sta_add+0x95/0x9c [rtw89_core \u003cHASH:d239 29\u003e]\n   rtw89_ops_sta_state+0x5d/0x108 [rtw89_core \u003cHASH:d239 29\u003e]\n   drv_sta_state+0x115/0x66f [mac80211 \u003cHASH:81fe 30\u003e]\n   sta_info_insert_rcu+0x45c/0x713 [mac80211 \u003cHASH:81fe 30\u003e]\n   sta_info_insert+0xf/0x1b [mac80211 \u003cHASH:81fe 30\u003e]\n   ieee80211_prep_connection+0x9d6/0xb0c [mac80211 \u003cHASH:81fe 30\u003e]\n   ieee80211_mgd_auth+0x2aa/0x352 [mac80211 \u003cHASH:81fe 30\u003e]\n   cfg80211_mlme_auth+0x160/0x1f6 [cfg80211 \u003cHASH:00cd 31\u003e]\n   nl80211_authenticate+0x2e5/0x306 [cfg80211 \u003cHASH:00cd 31\u003e]\n   genl_rcv_msg+0x371/0x3a1\n   ? nl80211_stop_sched_scan+0xe5/0xe5 [cfg80211 \u003cHASH:00cd 31\u003e]\n   ? genl_rcv+0x36/0x36\n   netlink_rcv_skb+0x8a/0xf9\n   genl_rcv+0x28/0x36\n   netlink_unicast+0x27b/0x3a0\n   netlink_sendmsg+0x2aa/0x469\n   sock_sendmsg_nosec+0x49/0x4d\n   ____sys_sendmsg+0xe5/0x213\n   __sys_sendmsg+0xec/0x157\n   ? syscall_enter_from_user_mode+0xd7/0x116\n   do_syscall_64+0x43/0x55\n   entry_SYSCALL_64_after_hwframe+0x44/0xa9\n  RIP: 0033:0x7fa99f6e689b","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"wifi: rtw89: 8852a: rfk: fix div 0 exception","id":"CVE-2022-50178","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2022"},"n_packages":0,"n_references":3,"next":{"headline":"ath9k: fix use-after-free in ath9k_hif_usb_rx_cb","id":"CVE-2022-50179"},"packages":[],"prev":{"headline":"rcutorture: Fix ksoftirqd boosting timing and iteration","id":"CVE-2022-50177"},"products":["Linux"],"published":"2025-06-18","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A divide-by-zero error in the rtw89 WiFi driver causes a kernel crash during RF calibration, leading to a denial of service.","url":"https://insights.sbomify.com/CVE-2022-50178/"}