CVE-2022-50871: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50871 is a vulnerability in the Linux kernel's ath11k Wi-Fi driver related to improper initialization of the qmi_msg_handler data structure. The QMI module requires the handler array to be null-terminated; if a handler for a given message ID is absent, the search loop can run indefinitely, leading to an infinite loop and subsequent out-of-bounds memory access in qmi_invoke_handler(). The vulnerability was published on December 30, 2025, and affects Linux kernel versions prior to the patched releases 6.0.16, 6.1.2, and 6.2. The CVSS base score is listed as 0.0 (no severity rating assigned at time of publication) (EUVD).

The root cause is improper initialization of the qmi_msg_handler array in the ath11k Wi-Fi driver (CWE-665: Improper Initialization). The QMI subsystem iterates over the handler array expecting a null terminator to signal the end of valid entries; without it, the loop continues past the array boundary, constituting an out-of-bounds read (CWE-125). The fix involves correctly null-terminating the qmi_msg_handler data structure so that qmi_invoke_handler() can safely detect the end of the array. The issue was tested on IPQ8074 hw2.0 AHB with firmware WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1 (EUVD, Kernel Patch 6.0).

Exploitation of this vulnerability could cause a kernel hang or system crash due to the infinite loop, resulting in a denial-of-service condition on affected devices. Out-of-bounds memory access in kernel space may also lead to memory corruption, potentially affecting system stability and integrity. The impact is primarily limited to systems using Qualcomm's ath11k-based Wi-Fi hardware (e.g., IPQ8074 SoCs), such as embedded routers and access points running affected Linux kernel versions (EUVD).

The Linux kernel project has released patches addressing this vulnerability in stable branches. Users should update to kernel versions 6.0.16, 6.1.2, or 6.2 (or later), which include the corrected null-termination of the qmi_msg_handler array. The relevant upstream commits are d5d71de448f36e34592f7c81b5e300d3e8dbb735 (6.0.x), a10e1530c424bb277b4edc7def0195857a548495, and ed3725e15a154ebebf44e0c34806c57525483f92 (6.1.x/6.2). Distributions shipping affected kernel versions with ath11k support should apply these patches promptly (EUVD).