CVE-2022-50164

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue

After successfull station association, if station queues are disabled for
some reason, the related lists are not emptied. So if some new element is
added to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old
one and produce a BUG like this:

[   46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388).
[   46.535283] ------------[ cut here ]------------
[   46.535284] kernel BUG at lib/list_debug.c:26!
[   46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[   46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1
[   46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN       , BIOS A07 08/24/2012
[   46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f
[   46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1
[   46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286
[   46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000
[   46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff
[   46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666
[   46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388
[   46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0
[   46.666108] FS:  00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000
[   46.674331] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0
[   46.687422] Call Trace:
[   46.689906]  <TASK>
[   46.691950]  iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm]
[   46.697601]  ieee80211_queue_skb+0x4b3/0x720 [mac80211]
[   46.702973]  ? sta_info_get+0x46/0x60 [mac80211]
[   46.707703]  ieee80211_tx+0xad/0x110 [mac80211]
[   46.712355]  __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211]
...

In order to avoid this problem, we must also remove the related lists when
station queues are disabled.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
LinuxCNA
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.237-1
fixed
bookworm
6.1.137-1
fixed
bookworm (security)
6.1.140-1
fixed
trixie (security)
6.12.31-1
fixed
sid
6.12.32-1
fixed
trixie
6.12.32-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-allwinner-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-aws
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-aws-5.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-aws-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-aws-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-aws-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-aws-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-aws-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-aws-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-aws-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-aws-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-aws-hwe
plucky
dne
oracular
dne
noble
dne
jammy
dne
xenial
needs-triage
linux-azure
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
trusty
needs-triage
linux-azure-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-azure-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-azure-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-azure-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-azure-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-azure-edge
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-azure-fde
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
ignored
linux-azure-fde-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-fde-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-fde-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-azure-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-azure-nvidia
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-bluefield
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-gcp
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
linux-gcp-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-gcp-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-gcp-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-gcp-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-gcp-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-gcp-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-gcp-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-gcp-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-gcp-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-gcp-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-gke
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gke-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-gke-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gke-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-gkeop
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gkeop-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gkeop-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-hwe
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
xenial
needs-triage
linux-hwe-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-hwe-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-hwe-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-hwe-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-hwe-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-hwe-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-hwe-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-hwe-edge
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
xenial
ignored
linux-ibm
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-ibm-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-ibm-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-intel-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-intel-iot-realtime
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-intel-iotg
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-intel-iotg-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-iot
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-kvm
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-lowlatency
plucky
dne
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
linux-lowlatency-hwe-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-lowlatency-hwe-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-lowlatency-hwe-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-lowlatency-hwe-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-lts-xenial
plucky
dne
oracular
dne
noble
dne
jammy
dne
trusty
needs-triage
linux-nvidia
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
linux-nvidia-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-nvidia-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-nvidia-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-nvidia-lowlatency
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-nvidia-tegra
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
linux-nvidia-tegra-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-nvidia-tegra-igx
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-oem
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-oem-5.10
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.14
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.17
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oem-5.6
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-6.0
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oem-6.1
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oem-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-oem-6.14
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-oem-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oem-6.8
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-oracle
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-oracle-5.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-oracle-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-oracle-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
ignored
linux-oracle-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-oracle-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-oracle-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-raspi
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-raspi-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
bionic
needs-triage
linux-raspi-realtime
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
linux-raspi2
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-realtime
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
linux-riscv
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
ignored
focal
ignored
linux-riscv-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-riscv-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-riscv-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-riscv-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
linux-starfive-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-starfive-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-starfive-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
linux-xilinx-zynqmp
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage