CVE-2022-50533: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's wifi mac80211 subsystem was identified as CVE-2022-50533. The issue involves a null pointer dereference that occurs during failed association attempts with access points without a link 0. The vulnerability was discovered and reported in October 2025 (NVD).

The vulnerability occurs in the mac80211 MLME (Media Access Control Layer Management Entity) component when attempting to associate with an AP without a link 0. The issue arises because the code assumes either apmldaddr or link 0 BSS is valid after clearing sdata->vif.valid_links, leading to a null pointer dereference during tracing. The vulnerability has been assigned a CVSS v3.1 score of 5.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) and is classified under CWE-476 (NULL Pointer Dereference) (Red Hat).

The vulnerability can result in a system crash when attempting to associate with certain access points, potentially leading to a denial of service condition. The impact is limited to local privilege escalation with low confidentiality impact but high availability impact (Red Hat).

The issue has been resolved in the Linux kernel by modifying the code to keep a local copy of sdata->vif.cfg.apaddr and assigning it earlier, before clearing validlinks. This fix prevents the null pointer dereference condition (NVD).