{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2022-50665",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-12-09T01:26:45.990Z",
        "datePublished": "2025-12-09T01:29:15.255Z",
        "dateUpdated": "2026-05-11T19:23:15.649Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-05-11T19:23:15.649Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected\n\nIt has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(),\nas below, it will not print when debug_mask is not set ATH11K_DBG_DATA.\n\tath11k_dbg(ab, ATH11K_DBG_DATA,\n\t\t  \"failed to find the peer with peer_id %d\\n\",\n\t\t   ppdu_info.peer_id);\n\nWhen run scan with station disconnected, the peer_id is 0 for case\nHAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called\nfrom ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is\nreset to 0 in the while loop, so it does not match condition of the\ncheck \"if (ppdu_info->peer_id == HAL_INVALID_PEERID\" in the loop, and\nthen the log \"failed to find the peer with peer_id 0\" print after the\ncheck in the loop, it is below call stack when debug_mask is set\nATH11K_DBG_DATA.\n\nThe reason is this commit 01d2f285e3e5 (\"ath11k: decode HE status tlv\")\nadd \"memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info))\" in\nath11k_dp_rx_process_mon_status(), but the commit does not initialize\nthe peer_id to HAL_INVALID_PEERID, then lead the check mis-match.\n\nCallstack of the failed log:\n[12335.689072] RIP: 0010:ath11k_dp_rx_process_mon_status+0x9ea/0x1020 [ath11k]\n[12335.689157] Code: 89 ff e8 f9 10 00 00 be 01 00 00 00 4c 89 f7 e8 dc 4b 4e de 48 8b 85 38 ff ff ff c7 80 e4 07 00 00 01 00 00 00 e9 20 f8 ff ff <0f> 0b 41 0f b7 96 be 06 00 00 48 c7 c6 b8 50 44 c1 4c 89 ff e8 fd\n[12335.689180] RSP: 0018:ffffb874001a4ca0 EFLAGS: 00010246\n[12335.689210] RAX: 0000000000000000 RBX: ffff995642cbd100 RCX: 0000000000000000\n[12335.689229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99564212cd18\n[12335.689248] RBP: ffffb874001a4dc0 R08: 0000000000000001 R09: 0000000000000000\n[12335.689268] R10: 0000000000000220 R11: ffffb874001a48e8 R12: ffff995642473d40\n[12335.689286] R13: ffff99564212c5b8 R14: ffff9956424736a0 R15: ffff995642120000\n[12335.689303] FS:  0000000000000000(0000) GS:ffff995739000000(0000) knlGS:0000000000000000\n[12335.689323] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[12335.689341] CR2: 00007f43c5d5e039 CR3: 000000011c012005 CR4: 00000000000606e0\n[12335.689360] Call Trace:\n[12335.689377]  <IRQ>\n[12335.689418]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689447]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689471]  ? rcu_read_lock_held_common+0x12/0x50\n[12335.689504]  ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689578]  ? ath11k_dp_rx_process_mon_rings+0x8d/0x4f0 [ath11k]\n[12335.689653]  ? lock_acquire+0xef/0x360\n[12335.689681]  ? rcu_read_lock_sched_held+0x25/0x80\n[12335.689713]  ath11k_dp_service_mon_ring+0x38/0x60 [ath11k]\n[12335.689784]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689860]  call_timer_fn+0xb2/0x2f0\n[12335.689897]  ? ath11k_dp_rx_process_mon_rings+0x4f0/0x4f0 [ath11k]\n[12335.689970]  run_timer_softirq+0x21f/0x540\n[12335.689999]  ? ktime_get+0xad/0x160\n[12335.690025]  ? lapic_next_deadline+0x2c/0x40\n[12335.690053]  ? clockevents_program_event+0x82/0x100\n[12335.690093]  __do_softirq+0x151/0x4a8\n[12335.690135]  irq_exit_rcu+0xc9/0x100\n[12335.690165]  sysvec_apic_timer_interrupt+0xa8/0xd0\n[12335.690189]  </IRQ>\n[12335.690204]  <TASK>\n[12335.690225]  asm_sysvec_apic_timer_interrupt+0x12/0x20\n\nReset the default value to HAL_INVALID_PEERID each time after memset\nof ppdu_info as well as others memset which existed in function\nath11k_dp_rx_process_mon_status(), then the failed log disappeared.\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3"
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wireless/ath/ath11k/dp_rx.c"
                    ],
                    "versions": [
                        {
                            "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
                            "lessThan": "c0bb97a90b133416b50b3ffbdb7efca9253cc687",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
                            "lessThan": "a5b03df19041e5ce35c7f048fa84bf1b0ceb1311",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "01d2f285e3e5b629df9c61514e7ee07a54d0eed9",
                            "lessThan": "a20ed60bb357776301c2dad7b4a4f0db97e143e9",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/wireless/ath/ath11k/dp_rx.c"
                    ],
                    "versions": [
                        {
                            "version": "5.18",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.18",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.19.17",
                            "lessThanOrEqual": "5.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0.3",
                            "lessThanOrEqual": "6.0.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.18",
                                    "versionEndExcluding": "5.19.17"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.18",
                                    "versionEndExcluding": "6.0.3"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.18",
                                    "versionEndExcluding": "6.1"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/c0bb97a90b133416b50b3ffbdb7efca9253cc687"
                },
                {
                    "url": "https://git.kernel.org/stable/c/a5b03df19041e5ce35c7f048fa84bf1b0ceb1311"
                },
                {
                    "url": "https://git.kernel.org/stable/c/a20ed60bb357776301c2dad7b4a4f0db97e143e9"
                }
            ],
            "title": "wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}