{
  "cveId": "CVE-2022-50551",
  "url": "https://patchblox.com/security/cve/CVE-2022-50551",
  "summary": "CVE-2022-50551 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50551, released October 7, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: brcmfmac: Fix potential shift-out-of-bound...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()  This patch fixes a shift-out-of-bounds in brcmfmac that occurs in BIT(chiprev) when a \u0027chiprev\u0027 provided by the device is too large. It should also not be equal to or greater than BITS_PER_TYPE(u32) as we do bitwise AND with a u32 variable and BIT(chiprev). The patch adds a check that makes the function return NULL if that is the case. Note that the NULL case is later handled by the bus-specific caller, brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example.  Found by a modified version of syzkaller.  UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c shift exponent 151055786 is too large for 64-bit type \u0027long unsigned int\u0027 CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G           O      5.14.0\u002B #132 Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace:  dump_stack_lvl\u002B0x57/0x7d  ubsan_epilogue\u002B0x5/0x40  __ubsan_handle_shift_out_of_bounds.cold\u002B0x53/0xdb  ? lock_chain_count\u002B0x20/0x20  brcmf_fw_alloc_request.cold\u002B0x19/0x3ea  ? brcmf_fw_get_firmwares\u002B0x250/0x250  ? brcmf_usb_ioctl_resp_wait\u002B0x1a7/0x1f0  brcmf_usb_get_fwname\u002B0x114/0x1a0  ? brcmf_usb_reset_resume\u002B0x120/0x120  ? number\u002B0x6c4/0x9a0  brcmf_c_process_clm_blob\u002B0x168/0x590  ? put_dec\u002B0x90/0x90  ? enable_ptr_key_workfn\u002B0x20/0x20  ? brcmf_common_pd_remove\u002B0x50/0x50  ? rcu_read_lock_sched_held\u002B0xa1/0xd0  brcmf_c_preinit_dcmds\u002B0x673/0xc40  ? brcmf_c_set_joinpref_default\u002B0x100/0x100  ? rcu_read_lock_sched_held\u002B0xa1/0xd0  ? rcu_read_lock_bh_held\u002B0xb0/0xb0  ? lock_acquire\u002B0x19d/0x4e0  ? find_held_lock\u002B0x2d/0x110  ? brcmf_usb_deq\u002B0x1cc/0x260  ? mark_held_locks\u002B0x9f/0xe0  ? lockdep_hardirqs_on_prepare\u002B0x273/0x3e0  ? _raw_spin_unlock_irqrestore\u002B0x47/0x50  ? trace_hardirqs_on\u002B0x1c/0x120  ? brcmf_usb_deq\u002B0x1a7/0x260  ? brcmf_usb_rx_fill_all\u002B0x5a/0xf0  brcmf_attach\u002B0x246/0xd40  ? wiphy_new_nm\u002B0x1476/0x1d50  ? kmemdup\u002B0x30/0x40  brcmf_usb_probe\u002B0x12de/0x1690  ? brcmf_usbdev_qinit.constprop.0\u002B0x470/0x470  usb_probe_interface\u002B0x25f/0x710  really_probe\u002B0x1be/0xa90  __driver_probe_device\u002B0x2ab/0x460  ? usb_match_id.part.0\u002B0x88/0xc0  driver_probe_device\u002B0x49/0x120  __device_attach_driver\u002B0x18a/0x250  ? driver_allows_async_probing\u002B0x120/0x120  bus_for_each_drv\u002B0x123/0x1a0  ? bus_rescan_devices\u002B0x20/0x20  ? lockdep_hardirqs_on_prepare\u002B0x273/0x3e0  ? trace_hardirqs_on\u002B0x1c/0x120  __device_attach\u002B0x207/0x330  ? device_bind_driver\u002B0xb0/0xb0  ? kobject_uevent_env\u002B0x230/0x12c0  bus_probe_device\u002B0x1a2/0x260  device_add\u002B0xa61/0x1ce0  ? __mutex_unlock_slowpath\u002B0xe7/0x660  ? __fw_devlink_link_to_suppliers\u002B0x550/0x550  usb_set_configuration\u002B0x984/0x1770  ? kernfs_create_link\u002B0x175/0x230  usb_generic_driver_probe\u002B0x69/0x90  usb_probe_device\u002B0x9c/0x220  really_probe\u002B0x1be/0xa90  __driver_probe_device\u002B0x2ab/0x460  driver_probe_device\u002B0x49/0x120  __device_attach_driver\u002B0x18a/0x250  ? driver_allows_async_probing\u002B0x120/0x120  bus_for_each_drv\u002B0x123/0x1a0  ? bus_rescan_devices\u002B0x20/0x20  ? lockdep_hardirqs_on_prepare\u002B0x273/0x3e0  ? trace_hardirqs_on\u002B0x1c/0x120  __device_attach\u002B0x207/0x330  ? device_bind_driver\u002B0xb0/0xb0  ? kobject_uevent_env\u002B0x230/0x12c0  bus_probe_device\u002B0x1a2/0x260  device_add\u002B0xa61/0x1ce0  ? __fw_devlink_link_to_suppliers\u002B0x550/0x550  usb_new_device.cold\u002B0x463/0xf66  ? hub_disconnect\u002B0x400/0x400  ? _raw_spin_unlock_irq\u002B0x24/0x30  hub_event\u002B0x10d5/0x3330  ? hub_port_debounce\u002B0x280/0x280  ? __lock_acquire\u002B0x1671/0x5790  ? wq_calc_node_cpumask\u002B0x170/0x2a0  ? lock_release\u002B0x640/0x640  ? rcu_read_lock_sched_held\u002B0xa1/0xd0  ? rcu_read_lock_bh_held\u002B0xb0/0xb0  ? lockdep_hardirqs_on_prepare\u002B0x273/0x3e0  process_one_work\u002B0x873/0x13e0  ? lock_release\u002B0x640/0x640  ? pwq_dec_nr_in_flight\u002B0x320/0x320  ? rwlock_bug.part.0\u002B0x90/0x90  worker_thread\u002B0x8b/0xd10  ? __kthread_parkme\u002B0xd9/0x1d0  ? pr ---truncated---",
  "published": "2025-10-07T16:15:41Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00223,
  "epssPercentile": 0.13045,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50551",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50551",
      "released": "2025-10-07T16:15:41Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50551",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50551",
      "released": "2025-10-07T16:15:41Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50551",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50551",
      "released": "2025-10-07T16:15:41Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}