CVE-2022-50701: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50701 is a slab-out-of-bounds memory access vulnerability in the Linux kernel's WiFi driver for the MediaTek MT7921S chipset (mt76/mt7921s) over SDIO. The flaw arises because SDIO bus operations may require up to 511 additional bytes for alignment, but the socket buffer (skb) tailroom is not guaranteed to be large enough, leading to invalid memory reads. It was published on December 24, 2025, and affects the Linux kernel. The CVSS score has not been formally assigned in available sources, and the CVE status is listed as Unknown (Feedly).

The root cause is a heap out-of-bounds read (CWE-125) in the mt7921s SDIO host driver. When the driver copies data via sg_copy_buffer → sg_copy_to_buffer → memcpy, it may read up to 511 bytes beyond the allocated skb tailroom to satisfy SDIO bus alignment requirements. The fix increases the skb allocation size to ensure valid memory access during low-level SDIO host operations. The KASAN error trace shows the out-of-bounds read occurring in sg_copy_buffer+0xe9/0x1a0 at address ffff88811c9cf000, triggered by a kernel worker thread (kworker/u16:7) (Feedly).

Exploitation of this vulnerability can cause a kernel crash (system unavailability) due to the slab-out-of-bounds memory access, impacting availability of the affected system. In the worst case, reading beyond allocated memory boundaries could expose sensitive kernel heap data, posing a limited confidentiality risk. The vulnerability is confined to systems using the MediaTek MT7921S WiFi chipset over SDIO, limiting its scope to specific embedded or laptop hardware configurations (Feedly).

The fix is available as a patch to the Linux kernel's mt76/mt7921s driver that increases the skb allocation size by up to 511 bytes to accommodate SDIO bus alignment requirements. Patches are referenced in the Linux stable kernel repository (commits 0b358e36433d, 8b5174a7f25d, and aec4cf2ea079). Users should apply the relevant kernel update for their distribution; SUSE has issued advisories (SUSE-2026:0263-1 and SUSE-2026:0317-1) addressing this CVE (Feedly, LinuxSecurity SUSE).