{
  "cveId": "CVE-2022-50665",
  "url": "https://patchblox.com/security/cve/CVE-2022-50665",
  "summary": "CVE-2022-50665 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50665, released December 9, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: fix failed to find the peer with p...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected  It has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(), as below, it will not print when debug_mask is not set ATH11K_DBG_DATA. \tath11k_dbg(ab, ATH11K_DBG_DATA, \t\t  \u0022failed to find the peer with peer_id %d\\n\u0022, \t\t   ppdu_info.peer_id);  When run scan with station disconnected, the peer_id is 0 for case HAL_RX_MPDU_START in ath11k_hal_rx_parse_mon_status_tlv() which called from ath11k_dp_rx_process_mon_status(), and the peer_id of ppdu_info is reset to 0 in the while loop, so it does not match condition of the check \u0022if (ppdu_info-\u003Epeer_id == HAL_INVALID_PEERID\u0022 in the loop, and then the log \u0022failed to find the peer with peer_id 0\u0022 print after the check in the loop, it is below call stack when debug_mask is set ATH11K_DBG_DATA.  The reason is this commit 01d2f285e3e5 (\u0022ath11k: decode HE status tlv\u0022) add \u0022memset(ppdu_info, 0, sizeof(struct hal_rx_mon_ppdu_info))\u0022 in ath11k_dp_rx_process_mon_status(), but the commit does not initialize the peer_id to HAL_INVALID_PEERID, then lead the check mis-match.  Callstack of the failed log: [12335.689072] RIP: 0010:ath11k_dp_rx_process_mon_status\u002B0x9ea/0x1020 [ath11k] [12335.689157] Code: 89 ff e8 f9 10 00 00 be 01 00 00 00 4c 89 f7 e8 dc 4b 4e de 48 8b 85 38 ff ff ff c7 80 e4 07 00 00 01 00 00 00 e9 20 f8 ff ff \u003C0f\u003E 0b 41 0f b7 96 be 06 00 00 48 c7 c6 b8 50 44 c1 4c 89 ff e8 fd [12335.689180] RSP: 0018:ffffb874001a4ca0 EFLAGS: 00010246 [12335.689210] RAX: 0000000000000000 RBX: ffff995642cbd100 RCX: 0000000000000000 [12335.689229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff99564212cd18 [12335.689248] RBP: ffffb874001a4dc0 R08: 0000000000000001 R09: 0000000000000000 [12335.689268] R10: 0000000000000220 R11: ffffb874001a48e8 R12: ffff995642473d40 [12335.689286] R13: ffff99564212c5b8 R14: ffff9956424736a0 R15: ffff995642120000 [12335.689303] FS:  0000000000000000(0000) GS:ffff995739000000(0000) knlGS:0000000000000000 [12335.689323] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12335.689341] CR2: 00007f43c5d5e039 CR3: 000000011c012005 CR4: 00000000000606e0 [12335.689360] Call Trace: [12335.689377]  \u003CIRQ\u003E [12335.689418]  ? rcu_read_lock_held_common\u002B0x12/0x50 [12335.689447]  ? rcu_read_lock_sched_held\u002B0x25/0x80 [12335.689471]  ? rcu_read_lock_held_common\u002B0x12/0x50 [12335.689504]  ath11k_dp_rx_process_mon_rings\u002B0x8d/0x4f0 [ath11k] [12335.689578]  ? ath11k_dp_rx_process_mon_rings\u002B0x8d/0x4f0 [ath11k] [12335.689653]  ? lock_acquire\u002B0xef/0x360 [12335.689681]  ? rcu_read_lock_sched_held\u002B0x25/0x80 [12335.689713]  ath11k_dp_service_mon_ring\u002B0x38/0x60 [ath11k] [12335.689784]  ? ath11k_dp_rx_process_mon_rings\u002B0x4f0/0x4f0 [ath11k] [12335.689860]  call_timer_fn\u002B0xb2/0x2f0 [12335.689897]  ? ath11k_dp_rx_process_mon_rings\u002B0x4f0/0x4f0 [ath11k] [12335.689970]  run_timer_softirq\u002B0x21f/0x540 [12335.689999]  ? ktime_get\u002B0xad/0x160 [12335.690025]  ? lapic_next_deadline\u002B0x2c/0x40 [12335.690053]  ? clockevents_program_event\u002B0x82/0x100 [12335.690093]  __do_softirq\u002B0x151/0x4a8 [12335.690135]  irq_exit_rcu\u002B0xc9/0x100 [12335.690165]  sysvec_apic_timer_interrupt\u002B0xa8/0xd0 [12335.690189]  \u003C/IRQ\u003E [12335.690204]  \u003CTASK\u003E [12335.690225]  asm_sysvec_apic_timer_interrupt\u002B0x12/0x20  Reset the default value to HAL_INVALID_PEERID each time after memset of ppdu_info as well as others memset which existed in function ath11k_dp_rx_process_mon_status(), then the failed log disappeared.  Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3",
  "published": "2025-12-09T16:17:18Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
  "epss": 0.00326,
  "epssPercentile": 0.25797,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.3-1",
      "fix": "DEBIAN-CVE-2022-50665",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50665",
      "released": "2025-12-09T16:17:18Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.3-1",
      "fix": "DEBIAN-CVE-2022-50665",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50665",
      "released": "2025-12-09T16:17:18Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.3-1",
      "fix": "DEBIAN-CVE-2022-50665",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50665",
      "released": "2025-12-09T16:17:18Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}