Executive brief
The ath10k WiFi driver in the Linux kernel has a use-after-free vulnerability that occurs when a peer deletion fails during device disconnect. When multiple firmware events map the same peer object to different peer IDs, freeing the peer on the first ID causes subsequent accesses via other IDs to reference freed memory, leading to kernel crashes or memory corruption.
Technical details
The vulnerability is a use-after-free (CWE-416) in the ath10k driver's peer deletion logic within ath10k_sta_state(). The root cause occurs because multiple HTT_T2H_MSG_TYPE_PEER_MAP events from firmware can map the same ath10k_peer structure to multiple entries in the driver's peer_map array. When peer deletion fails during disconnect, the first invocation frees the ath10k_peer structure, but subsequent array entries still reference the freed memory. This is triggered by a failed peer delete operation (returning -110) during deauthentication. The fix adds cleanup of all peer_map entries pointing to the deleted peer to prevent use-after-free. No authentication or user interaction is required; the vulnerability manifests during normal WiFi disconnect operations.
Affected products
- Linux Linux kernel affected versions in ath10k driver (prior to fix)
Timeline
- 2025-12-30: disclosed: CVE-2022-50880 published
- 2022: other: Vulnerability resolved in kernel