CVE-2022-50258: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50258 is a stack-out-of-bounds read vulnerability in the Linux kernel's Broadcom WiFi driver (brcmfmac) within the brcmf_c_preinit_dcmds() function. The flaw occurs when a buffer containing a firmware version string, filled via memcpy() in brcmf_fil_iovar_data_get(), is passed without null-termination to strsep(), potentially causing out-of-bounds memory access. Affected kernel versions span multiple stable branches: before 4.14.308, 4.15–4.19.276, 4.20–5.4.235, 5.5–5.10.173, 5.11–5.15.99, 5.16–6.1.16, and 6.2–6.2.3. The vulnerability was publicly disclosed on September 15, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-787 (Out-of-bounds Write), though the observable behavior is a stack-out-of-bounds read triggered in strsep() when it iterates past the end of a non-null-terminated buffer. Specifically, brcmf_fil_iovar_data_get() uses memcpy() to populate a stack buffer (buf) with a firmware version string without appending a null terminator; this buffer is then passed to strsep() in brcmf_c_preinit_dcmds(), which reads beyond the buffer boundary. The vulnerability was discovered using a modified version of syzkaller, a kernel fuzzing tool, and is triggered during USB device probe when a Broadcom WiFi adapter is attached. The attack vector is local, requiring low privileges and no user interaction (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation by a low-privileged local attacker could result in reading sensitive kernel stack memory contents (confidentiality impact), potential kernel integrity compromise, or a kernel crash causing denial of service (availability impact). The vulnerability affects systems with Broadcom WiFi hardware using the brcmfmac driver, and could theoretically be leveraged to leak kernel address space information useful for bypassing KASLR in chained exploit scenarios. The CVSS v3.1 scoring reflects high impacts across confidentiality, integrity, and availability (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and physical or logical access to a system with a Broadcom WiFi adapter using the affected driver (Red Hat Advisory).

The primary remediation is to update the Linux kernel to a patched version: 4.14.308+, 4.19.276+, 5.4.235+, 5.10.173+, 5.15.99+, 6.1.16+, or 6.2.3+. Patches are available via the upstream kernel stable tree (kernel.org patches). As a workaround for systems that cannot be immediately patched, administrators can blacklist or disable the brcmfmac kernel module if Broadcom WiFi functionality is not required (echo 'blacklist brcmfmac' >> /etc/modprobe.d/blacklist.conf). Restricting local user access to minimize the attack surface is also recommended (Red Hat Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their security response process and assigned it a medium severity rating in their Bugzilla system. SUSE has issued kernel update advisories (SUSE-2025-03613-1, SUSE-2025-03628-1, SUSE-2025-3716-1) addressing this CVE among others. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability (Red Hat Bugzilla, Linux Security SUSE Advisory).