CVE-2022-50700: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50700 is a race condition vulnerability in the Linux kernel's ath10k Wi-Fi driver affecting Qualcomm WCN3990 chipsets. The flaw involves premature unmapping of DMA buffers on copy engine channel 3 (CE3) before the hardware has finished processing them, leading to SMMU faults and kernel panics. It was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. The CVSS score has not been formally assigned in available sources, and the CVE status is listed as Unknown (Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the ath10k driver's copy engine interrupt handling. On WCN3990 hardware, the copy engine can fire a copy-complete interrupt to the host driver while still actively reading the associated DMA buffer. Upon receiving this interrupt, the driver immediately unmaps and frees the buffer (via dma_unmap_single), but since the hardware is concurrently accessing the now-unmapped memory, the SMMU triggers an unhandled context fault (fsr=0x402) resulting in a kernel panic. The fix introduces a conditional delay before unmapping the CE3 source DMA buffer, applied only to WCN3990 to avoid impacting other hardware configurations (Feedly).

Successful triggering of this vulnerability causes a kernel panic (system crash), resulting in a complete loss of availability for the affected system. The crash is triggered by an SMMU fault when the hardware accesses an already-unmapped DMA buffer, and there is no evidence of confidentiality or integrity impact beyond the denial-of-service condition. The vulnerability is limited to systems using the Qualcomm WCN3990 Wi-Fi chipset with the ath10k driver on the Linux kernel (Feedly).

• Logs: Kernel log entries containing arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402 with associated iova and cbfrsynra=0xc1 fields.
• Logs: Kernel panic traces referencing ath10k or qcom-q6v components in /var/log/kern.log or dmesg output.
• Process/System: Unexpected system reboots or kernel oops events on devices equipped with Qualcomm WCN3990 Wi-Fi hardware running affected Linux kernel versions.

The fix has been merged into the Linux kernel stable tree via commits to multiple stable branches (referenced at git.kernel.org). Users should update to a patched kernel version that includes the ath10k CE3 DMA unmap delay fix. SUSE has issued kernel security advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0350-1, SUSE-2026-0411-1, SUSE-2026-0707-1) addressing this CVE among others (Linux Security SUSE). As a workaround, disabling the ath10k driver on affected WCN3990 hardware (if Wi-Fi is not required) would prevent the crash, though upgrading the kernel is the recommended remediation.