Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2022-50735— wifi: mt76: do not run mt76u_status_worker if the device is not running

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于设备未运行时运行mt76u_status_worker，可能导致空指针取消引用。

AI Predicted 5.5 Difficulty: Hard EPSS 0.24% · P15 Updated May 13, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 10

Vendor	Product	Version Range	Status
Linux	Linux	`9daf27e62852d68c6ffc2c21090238ea51bb0a7f< 69346de0eb956fb92949b9473de4647d9c34a54f`	affected
		`9daf27e62852d68c6ffc2c21090238ea51bb0a7f< 58fdd84a89b121b761dbfb8a196356e007376ca4`	affected
		`9daf27e62852d68c6ffc2c21090238ea51bb0a7f< f5ac749a0b21beee55d87d0b05de36976b22dff9`	affected
		`9daf27e62852d68c6ffc2c21090238ea51bb0a7f< bd5dac7ced5a7c9faa4dc468ac9560c3256df845`	affected
		`5.11`	affected
		`< 5.11`	unaffected
		`5.15.86≤ 5.15.*`	unaffected
		`6.0.16≤ 6.0.*`	unaffected
… +2 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-50735

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

wifi: mt76: do not run mt76u_status_worker if the device is not running

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: do not run mt76u_status_worker if the device is not running Fix the following NULL pointer dereference avoiding to run mt76u_status_worker thread if the device is not running yet. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 98 Comm: kworker/u2:2 Not tainted 5.14.0+ #78 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: mt76 mt76u_tx_status_data RIP: 0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: mt76x02_send_tx_status+0x1d2/0xeb0 mt76x02_tx_status_data+0x8e/0xd0 mt76u_tx_status_data+0xe1/0x240 process_one_work+0x92b/0x1460 worker_thread+0x95/0xe00 kthread+0x3a1/0x480 ret_from_fork+0x1f/0x30 Modules linked in: --[ end trace 8df5d20fc5040f65 ]-- RIP: 0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554 Moreover move stat_work schedule out of the for loop.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	9daf27e62852d68c6ffc2c21090238ea51bb0a7f ~ 69346de0eb956fb92949b9473de4647d9c34a54f	-
Linux	Linux	5.11	-

II. Public POCs for CVE-2022-50735

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2022-50735

请登录查看更多情报信息。

Other References for CVE-2022-50735 (2)

https://www.cve.org/CVERecord?id=CVE-2022-50735

Same Patch Batch · Linux · 2025-12-24 · 322 CVEs total

CVE-2023-54076	9.8 CRITICAL	smb: client: fix missed ses refcounting
CVE-2022-50717	9.8 CRITICAL	nvmet-tcp: add bounds check on Transfer Tag
CVE-2025-68741	9.8 CRITICAL	scsi: qla2xxx: Fix improper freeing of purex item
CVE-2025-68359	9.8 CRITICAL	btrfs: fix double free of qgroup record after failure to add delayed ref head
CVE-2025-68726	9.8 CRITICAL	crypto: aead - Fix reqsize handling
CVE-2025-68745	9.8 CRITICAL	scsi: qla2xxx: Clear cmds after chip reset
CVE-2023-54090	9.8 CRITICAL	ixgbe: Fix panic during XDP_TX with > 64 CPUs
CVE-2023-53867	9.8 CRITICAL	ceph: fix potential use-after-free bug when trimming caps
CVE-2023-54094	9.8 CRITICAL	net: prevent skb corruption on frag list segmentation
CVE-2023-53996	9.3 CRITICAL	x86/sev: Make enc_dec_hypercall() accept a size instead of npages
CVE-2023-54043	8.8 HIGH	iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
CVE-2023-54040	8.8 HIGH	ice: fix wrong fallback logic for FDIR
CVE-2023-54060	8.8 HIGH	iommufd: Set end correctly when doing batch carry
CVE-2022-50732	8.8 HIGH	staging: rtl8192u: Fix use after free in ieee80211_rx()
CVE-2023-54071	8.8 HIGH	wifi: rtw88: use work to update rate to avoid RCU warning
CVE-2025-68736	8.8 HIGH	landlock: Fix handling of disconnected directories
CVE-2023-54092	8.8 HIGH	KVM: s390: pv: fix index value of replaced ASCE
CVE-2023-54120	8.8 HIGH	Bluetooth: Fix race condition in hidp_session_thread
CVE-2023-53986	8.6 HIGH	mips: bmips: BCM6358: disable RAC flush for TP1
CVE-2022-50746	8.4 HIGH	erofs: validate the extent length for uncompressed pclusters

Showing top 20 of 322 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2022-50735

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2022-50735— wifi: mt76: do not run mt76u_status_worker if the device is not running

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 10

I. Basic Information for CVE-2022-50735

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2022-50735

III. Intelligence Information for CVE-2022-50735

Other References for CVE-2022-50735 (2)

Same Patch Batch · Linux · 2025-12-24 · 322 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2022-50735

Leave a comment