{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2022-50665 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-50665 is a high-severity vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-50665 and fix it if it is affected.\n\nWhat it is: CVE-2022-50665 is a high-severity vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-50665 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-50665/ (Markdown: https://insights.sbomify.com/CVE-2022-50665/index.md)","id":"CVE-2022-50665","markdown":"https://insights.sbomify.com/CVE-2022-50665/index.md","name":"CVE-2022-50665","record":{"aliases":["DEBIAN-CVE-2022-50665","GHSA-ppjq-9892-q46w","UBUNTU-CVE-2022-50665"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel WiFi driver","requires_auth":"none","summary":"A missing initialization in the ath11k WiFi driver causes a kernel crash when processing monitor status frames during scanning.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected\n\nIt has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(),\nas below, it will not print when debug_mask is not set ATH11K_DBG_DATA.\n\tath11k_dbg(ab, ATH11K_DBG_DATA,\n\t\t  \"failed to find the peer with peer_id %d\\n\",\n\t\t   ppdu_info.peer_id);\n\nWhen run scan with station disconnected, the peer_id is 0 for case\nHAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called\nfrom ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is\nreset to 0 in the while loop, so it does not match condition of the\ncheck \"if (ppdu_info-\u003epeer_id == HAL_INVALID_PEERID\" in the loop, and\nthen the log \"failed to find the peer with peer_id 0\" print after the\ncheck in the loop, it is below call stack when debug_mask is set\nATH11K_DBG_DATA.\n\nThe reason is this commit 01d2f285e3e5 (\"ath11k: decode HE status tlv\")\nadd \"memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info))\" in\nath11k_dp_rx_process_mon_status(), but the commit does not initialize\nthe peer_id to HAL_INVALID_PEERID, then lead the check mis-match.\n\nCallstack of the failed log:\n[12335.689072] RIP: 0010:ath11k_dp_rx_process_mon_status+0x9ea/0x1020 [ath11k]\n[12335.689157] Code: 89 ff e8 f9 10 00 00 be 01 00 00 00 4c 89 f7 e8 dc 4b 4e de 48 8b 85 38 ff ff ff c7 80 e4 07 00 00 01 00 00 00 e9 20 f8 ff ff \u003c0f\u003e 0b 41 0f b7 96 be 06 00 00 48 c7 c6 b8 50 44 c1 4c 89 ff e8 fd\n[12335.689180] RSP: 0018:ffffb874001a4ca0 EFLAGS: 00010246\n[12335.689210] RAX: 0000000000000000 RBX: ffff995642cbd100 RCX: 0000000000000000\n[12335.689229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99564212cd18\n[12335.689248] RBP: ffffb874001a4dc0 R08: 0000000000000001 R09: 0000000000000000\n[12335.689268] R10: 0000000000000220 R11: ffffb874001a48e8 R12: ffff995642473d40\n[12335.689286] R13: ffff99564212c5b8 R14: ffff9956424736a0 R15: ffff995642120000\n[12335.689303] FS:  0000000000000000(0000) GS:ffff995739000000(0000) knlGS:0000000000000000\n[12335.689323] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[12335.689341] CR2: 00007f43c5d5e039 CR3: 000000011c012005 CR4: 00000000000606e0\n[12335.689360] Call Trace:\n[12335.689377]  \u003cIRQ\u003e\n[12335.689418]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689447]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689471]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689504]  ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689578]  ? ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689653]  ? lock_acquire+0xef/0x360\n[12335.689681]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689713]  ath11k_dp_service_mon_ring+0x38/0x60 [ath11k]\n[12335.689784]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689860]  call_timer_fn+0xb2/0x2f0\n[12335.689897]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689970]  run_timer_softirq+0x21f/0x540\n[12335.689999]  ? ktime_get+0xad/0x160\n[12335.690025]  ? lapic_next_deadline+0x2c/0x40\n[12335.690053]  ? clockevents_program_event+0x82/0x100\n[12335.690093]  __do_softirq+0x151/0x4a8\n[12335.690135]  irq_exit_rcu+0xc9/0x100\n[12335.690165]  sysvec_apic_timer_interrupt+0xa8/0xd0\n[12335.690189]  \u003c/IRQ\u003e\n[12335.690204]  \u003cTASK\u003e\n[12335.690225]  asm_sysvec_apic_timer_interrupt+0x12/0x20\n\nReset the default value to HAL_INVALID_PEERID each time after memset\nof ppdu_info as well as others memset which existed in function\nath11k_dp_rx_process_mon_status(), then the failed log disappeared.\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected","id":"CVE-2022-50665","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2022"},"n_packages":0,"n_references":3,"next":{"headline":"RDMA/siw: Fix QP destroy to wait for all references dropped.","id":"CVE-2022-50666"},"packages":[],"prev":{"headline":"media: dvb-frontends: fix leak of memory fw","id":"CVE-2022-50664"},"products":["Linux"],"published":"2025-12-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"A missing initialization in the ath11k WiFi driver causes a kernel crash when processing monitor status frames during scanning.","url":"https://insights.sbomify.com/CVE-2022-50665/"}