CVE-2022-50880: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50880 is a use-after-free vulnerability in the Linux kernel's ath10k Wi-Fi driver, specifically within the ath10k_sta_state() function during peer deletion on disconnect. When a peer delete operation fails, the ath10k_peer structure is freed for the first peer ID in the peer_map array, but subsequent peer IDs that map to the same structure are not cleaned up, resulting in a use-after-free condition detectable via KFENCE. The vulnerability was published on December 30, 2025, and affects the Linux kernel's ath10k wireless driver. The CVSS category is estimated as Medium (Feedly, CVE.org).

The root cause is a use-after-free (CWE-416) in the ath10k Wi-Fi driver. When an access point sends multiple HTT_T2H_MSG_TYPE_PEER_MAP messages for the same peer MAC address and vdev ID, the peer_map array in struct ath10k is populated with multiple indices all pointing to the same ath10k_peer object. If peer deletion subsequently fails in ath10k_sta_state(), the code frees the ath10k_peer for the first peer ID but leaves the remaining peer map entries dangling, causing a use-after-free when those entries are later accessed. The fix involves cleaning up all entries in the peer_map array that reference the same ath10k_peer upon deletion failure (Feedly, CVE.org).

Successful exploitation of this vulnerability could allow a local attacker or a malicious Wi-Fi access point to trigger kernel memory corruption via the use-after-free condition, potentially leading to a kernel crash (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The impact is primarily on availability and integrity of the affected Linux system, with confidentiality risks if kernel memory contents are exposed through the freed structure (Feedly).

The fix has been applied to the Linux kernel stable tree via multiple commits (e.g., 2bf916418d21, 2d6259715c95, 08faf07717be, 54a3201f3c1f, 4494ec1c0bb8) that clean up all peer_map entries referencing the affected ath10k_peer on deletion failure. Users should update to a patched Linux kernel version that includes these fixes. Distributions such as SUSE have issued advisories incorporating this fix (e.g., SUSE kernel update SUSE-2026:0350-1). As a workaround, avoiding connection to untrusted Wi-Fi access points on affected hardware reduces exposure (Feedly, Linux Security).