CVE-2022-50186: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50186 is a memory leak vulnerability in the Linux kernel's ath11k Wi-Fi driver caused by a missing socket buffer (skb) drop on htc_tx_completion error. When an error is triggered in the HTC TX completion path, the skb is not freed, resulting in a memory leak since the completion handler expects the skb to be consumed regardless of error status. The vulnerability affects Linux kernel versions 5.17 through 5.18.17 and 5.19 through 5.19.1. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the ath11k driver's htc_tx_completion error handling path, when the endpoint ID (eid) is greater than or equal to ATH11K_HTC_EP_COUNT, the function returns early without freeing the associated skb. Because the completion handler logic assumes the skb will always be consumed — even on error — the unreleased skb results in a kernel memory leak. The fix ensures the packet is correctly freed before returning in the error case. The vulnerability was tested on IPQ8074 hw2.0 AHB with firmware WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1 (Feedly, Kernel Patch 1).

Exploitation of this vulnerability results in a kernel memory leak, degrading system availability over time as unreleased memory accumulates. There is no confidentiality or integrity impact; the primary consequence is a denial-of-service condition through resource exhaustion on systems using the ath11k Wi-Fi driver. The vulnerability requires local access with low privileges to trigger, limiting its scope to the affected system (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50186. The EPSS score is extremely low at 0.017%, reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable via Qualys scanner (detection ID 759028) (Feedly).

The Linux kernel project has released patches addressing this vulnerability. Users should upgrade to Linux kernel version 5.18.18 or later (for the 5.17–5.18 branch) or 5.19.2 or later (for the 5.19 branch). Three upstream stable commits address this issue: 1f14833, dda2532, and e5646fe. Linux distributions should apply the relevant kernel updates from their respective vendors (Feedly).

Coverage of this vulnerability has been limited to standard vulnerability tracking and scanning platforms. Pro-Linux.de noted it among multiple Linux security issues in a July 2025 advisory (Pro-Linux). Tenable added detection support via Nessus plugin 248816 and pipeline issue tracking (Tenable). No notable researcher commentary or significant social media discussion has been identified.