CVE-2022-50361 wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
A missing unregister_netdev call in the wilc1000 WiFi driver error path causes a kernel BUG and system crash when workqueue allocation fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50361?
CVE-2022-50361 is a medium-severity vulnerability in Linux kernel, published on 17 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
Fault injection test reports this issue:
kernel BUG at net/core/dev.c:10731! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI Call Trace: <TASK> wilc_netdev_ifc_init+0x19f/0x220 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5] wilc_cfg80211_init+0x30c/0x380 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5] wilc_bus_probe+0xad/0x2b0 [wilc1000_spi 1520a7539b6589cc6cde2ae826a523a33f8bacff] spi_probe+0xe4/0x140 really_probe+0x17e/0x3f0 __driver_probe_device+0xe3/0x170 driver_probe_device+0x49/0x120
The root case here is alloc_ordered_workqueue() fails, but cfg80211_unregister_netdevice() or unregister_netdev() not be called in error handling path. To fix add unregister_netdev goto lable to add the unregister operation in error handling path.
Weakness: CWE-476
Which versions are affected by CVE-2022-50361?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50361?
Apply the vendor's patch.
Is CVE-2022-50361 being exploited?
There is no known exploitation of CVE-2022-50361 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-50361, GHSA-h5ff-9294-whpm, UBUNTU-CVE-2022-50361.