{"id":"CVE-2022-50665","revision":null,"records":[{"revision":"aacd4b637dc7493991de567acfec598e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2022-50665","aliases":[],"title":"wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected\n\nIt has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(),\nas below, it will not print when debug_mask is not set ATH11K_DBG_DATA.\n\tath11k_dbg(ab, ATH11K_DBG_DATA,\n\t\t  \"failed to find the peer with peer_id %d\\n\",\n\t\t   ppdu_info.peer_id);\n\nWhen run scan with station disconnected, the peer_id is 0 for case\nHAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called\nfrom ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is\nreset to 0 in the while loop, so it does not match condition of the\ncheck \"if (ppdu_info->peer_id == HAL_INVALID_PEERID\" in the loop, and\nthen the log \"failed to find the peer with peer_id 0\" print after the\ncheck in the loop, it is below call stack when debug_mask is set\nATH11K_DBG_DATA.\n\nThe reason is this commit 01d2f285e3e5 (\"ath11k: decode HE status tlv\")\nadd \"memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info))\" in\nath11k_dp_rx_process_mon_status(), but the commit does not initialize\nthe peer_id to HAL_INVALID_PEERID, then lead the check mis-match.\n\nCallstack of the failed log:\n[12335.689072] RIP: 0010:ath11k_dp_rx_process_mon_status+0x9ea/0x1020 [ath11k]\n[12335.689157] Code: 89 ff e8 f9 10 00 00 be 01 00 00 00 4c 89 f7 e8 dc 4b 4e de 48 8b 85 38 ff ff ff c7 80 e4 07 00 00 01 00 00 00 e9 20 f8 ff ff <0f> 0b 41 0f b7 96 be 06 00 00 48 c7 c6 b8 50 44 c1 4c 89 ff e8 fd\n[12335.689180] RSP: 0018:ffffb874001a4ca0 EFLAGS: 00010246\n[12335.689210] RAX: 0000000000000000 RBX: ffff995642cbd100 RCX: 0000000000000000\n[12335.689229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99564212cd18\n[12335.689248] RBP: ffffb874001a4dc0 R08: 0000000000000001 R09: 0000000000000000\n[12335.689268] R10: 0000000000000220 R11: ffffb874001a48e8 R12: ffff995642473d40\n[12335.689286] R13: ffff99564212c5b8 R14: ffff9956424736a0 R15: ffff995642120000\n[12335.689303] FS:  0000000000000000(0000) GS:ffff995739000000(0000) knlGS:0000000000000000\n[12335.689323] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[12335.689341] CR2: 00007f43c5d5e039 CR3: 000000011c012005 CR4: 00000000000606e0\n[12335.689360] Call Trace:\n[12335.689377]  <IRQ>\n[12335.689418]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689447]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689471]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689504]  ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689578]  ? ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689653]  ? lock_acquire+0xef/0x360\n[12335.689681]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689713]  ath11k_dp_service_mon_ring+0x38/0x60 [ath11k]\n[12335.689784]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689860]  call_timer_fn+0xb2/0x2f0\n[12335.689897]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689970]  run_timer_softirq+0x21f/0x540\n[12335.689999]  ? ktime_get+0xad/0x160\n[12335.690025]  ? lapic_next_deadline+0x2c/0x40\n[12335.690053]  ? clockevents_program_event+0x82/0x100\n[12335.690093]  __do_softirq+0x151/0x4a8\n[12335.690135]  irq_exit_rcu+0xc9/0x100\n[12335.690165]  sysvec_apic_timer_interrupt+0xa8/0xd0\n[12335.690189]  </IRQ>\n[12335.690204]  <TASK>\n[12335.690225]  asm_sysvec_apic_timer_interrupt+0x12/0x20\n\nReset the default value to HAL_INVALID_PEERID each time after memset\nof ppdu_info as well as others memset which existed in function\nath11k_dp_rx_process_mon_status(), then the failed log disappeared.\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3","state":0,"publishedAt":"2025-12-09T01:29:15.255+00:00","modifiedAt":"2026-10-15T21:41:22.267+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/ath/ath11k/dp_rx.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"01d2f285e3e5b629df9c61514e7ee07a54d0eed9\",\n                            \"lessThan\": \"c0bb97a90b133416b50b3ffbdb7efca9253cc687\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"01d2f285e3e5b629df9c61514e7ee07a54d0eed9\",\n                            \"lessThan\": \"a5b03df19041e5ce35c7f048fa84bf1b0ceb1311\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"01d2f285e3e5b629df9c61514e7ee07a54d0eed9\",\n                            \"lessThan\": \"a20ed60bb357776301c2dad7b4a4f0db97e143e9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/ath/ath11k/dp_rx.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.19.17\",\n                            \"lessThanOrEqual\": \"5.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.0.3\",\n                            \"lessThanOrEqual\": \"6.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/c0bb97a90b133416b50b3ffbdb7efca9253cc687","https://git.kernel.org/stable/c/a5b03df19041e5ce35c7f048fa84bf1b0ceb1311","https://git.kernel.org/stable/c/a20ed60bb357776301c2dad7b4a4f0db97e143e9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-50665","license":"CVE Program Terms of Use","key":"cve-program:CVE-2022-50665","identifiers":["CVE-2022-50665"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T14:04:00.1516715+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T14:04:00.1516715+00:00","lastSuccessAt":"2026-11-09T14:04:00.2969466+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:04:00.2969495+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-63bead6b33209140263fb436f2f7924cdf0a57ddb97fc634114a22ac37965cfc","complete":true,"records":421444,"lastAttemptAt":"2026-11-09T14:02:14.5012261+00:00","lastSuccessAt":"2026-11-09T14:02:14.4549407+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:02:14.5012261+00:00","snapshotPublishedAt":"2026-11-09T13:24:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-046cc59a602149d09a1f1f2780b9fecb","complete":false,"records":13655,"lastAttemptAt":"2026-11-09T14:11:47.1111179+00:00","lastSuccessAt":"2026-11-09T14:11:47.200021+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:11:47.200021+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T14:04:00.1516715+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T14:04:00.1516715+00:00","lastSuccessAt":"2026-11-09T14:04:00.2978136+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:04:00.297814+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fec5a400f2004099a6ceb2e015ba7713","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T14:04:00.8740665+00:00","lastSuccessAt":"2026-11-09T13:04:37.338+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:04:37.338+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T14:04:00.1058982+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:04:00.1058982+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T14:02:14.6544671+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:02:14.6544671+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T14:04:00.1196922+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:04:00.1196922+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-0a2950eb931e2cbd521c1ee48327cd287727b9b342d55a1210c0101010ad92b5","complete":true,"records":231299,"lastAttemptAt":"2026-11-09T14:03:59.9741082+00:00","lastSuccessAt":"2026-11-09T14:03:58.6011989+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:03:59.9741082+00:00","snapshotPublishedAt":"2026-11-09T13:48:25+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}