CVE-2022-50665: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50665 is a logic error vulnerability in the Linux kernel's ath11k Wi-Fi driver affecting the ath11k_dp_rx_process_mon_status() function. The flaw causes a spurious debug log message — "failed to find the peer with peer_id 0" — when a station is disconnected and a scan is run, due to an incorrect initialization of peer_id after a memset call. It was published on December 9, 2025, and affects the Linux kernel. Feedly estimates the severity as Medium, with an EPSS score of 0.00017 (Feedly, VulDB).

The root cause is an improper initialization issue (CWE-665) introduced by commit 01d2f285e3e5 ("ath11k: decode HE status tlv"), which added a memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info)) in ath11k_dp_rx_process_mon_status() but failed to subsequently initialize peer_id to HAL_INVALID_PEERID. As a result, when ath11k_hal_rx_parse_mon_status_tlv() processes an HAL_RX_MPDU_START TLV during a disconnected scan, peer_id is reset to 0 rather than the sentinel invalid value, causing the peer lookup condition if (ppdu_info->peer_id == HAL_INVALID_PEERID) to be skipped and triggering the erroneous debug log. The fix initializes peer_id to HAL_INVALID_PEERID after the memset to restore correct behavior (Feedly).

The practical impact of this vulnerability is limited to incorrect debug logging behavior in the ath11k Wi-Fi driver when a wireless station is disconnected and scanning. There is no evidence of confidentiality, integrity, or availability impact beyond potential diagnostic confusion; the flaw does not expose sensitive data, allow privilege escalation, or enable remote code execution. Systems with ATH11K_DBG_DATA debug mask enabled may generate misleading log entries, but normal operation is otherwise unaffected (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50665. The EPSS score is 0.00017 (approximately 0.017%), indicating a very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 277969 (Tenable, Feedly).

The fix is available in the Linux kernel stable tree via commits a5b03df19041, a20ed60bb357, and c0bb97a90b13, which initialize ppdu_info->peer_id to HAL_INVALID_PEERID after the memset call. Users should apply the relevant kernel update for their distribution; SUSE has issued advisories (SUSE-2026:0263-1 and SUSE-2026:0317-1) incorporating this fix. No configuration-based workaround is required, as the issue only produces spurious debug output and does not represent an exploitable security risk (Linux Security SUSE Advisory, Linux Security SUSE Advisory 2).