Memory Leak Vulnerability in Linux Kernel: ath11k Component
Summary
CVE-2022-50186: In the Linux kernel, the following vulnerability has been resolved: ath11k: fix missing skb drop on htc_tx_completion error On htc_tx_completion error the skb is not dropped. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. The ath11k component is responsible for handling wireless communication in devices using Qualcomm chipsets. This component is crucial for ensuring stable and efficient wireless connectivity. However, it is susceptible to vulnerabilities that can lead to memory leaks, affecting system performance and reliability.
Vulnerability Detail
The vulnerability identified as CVE-2022-50186 arises from a failure to drop the socket buffer (skb) on encountering an htc_tx_completion error in the ath11k component. This oversight leads to a memory leak, as the skb is not freed, resulting in unconsumed memory that can accumulate over time. The completion_handler logic expects the skb to be consumed regardless of whether an error occurs, making this a critical issue that could degrade system performance and stability.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The CVE-2022-50186 vulnerability in the Linux kernel's ath11k component poses a significant risk due to memory leaks caused by improper error handling. Users are strongly encouraged to update their systems to the patched version to mitigate potential impacts on performance and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50186 is a vulnerability in the Linux kernel's ath11k component that causes a memory leak due to improper handling of socket buffers on error.
This vulnerability can lead to increased memory usage over time, potentially degrading system performance and stability.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
While there are no specific workarounds, it is advisable to monitor system performance and apply the update as soon as possible.
More details can be found in the official CVE database or by visiting the provided source link in the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
