high 7.1

CVE-2022-50279 json

wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

published 2025-09-15 13 mo ago modified 2026-11-05 3 d ago also EUVD-2022-55576

cvss: 7.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

There is a global-out-of-bounds reported by KASAN:

BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411

CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK>

The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough.

Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit.

Patch / fix

fixed in 1 distros 4 links 7

Linux Linux 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3

debian ubuntu red hat suse

linux Debian 14, Debian 13, Debian 12 6.1.20-1

debian advisories DEBIAN-CVE-2022-50279

linux Ubuntu 20.04 LTS 5.4.0-152.169
linux Ubuntu 22.04 LTS 5.15.0-75.82
linux-aws Ubuntu 20.04 LTS 5.4.0-1104.112
linux-aws Ubuntu 22.04 LTS 5.15.0-1038.43
linux-gcp Ubuntu 20.04 LTS 5.4.0-1107.116
linux-gcp Ubuntu 22.04 LTS 5.15.0-1036.44
linux-gke Ubuntu 22.04 LTS 5.15.0-1036.41
linux-ibm Ubuntu 20.04 LTS 5.4.0-1051.56

ubuntu advisories UBUNTU-CVE-2022-50279

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 8 4.18.0-513.5.1.el8_9
perf RHEL 8 4.18.0-513.5.1.el8_9
bpftool RHEL 8 4.18.0-513.5.1.el8_9
kernel-core RHEL 8 4.18.0-513.5.1.el8_9
kernel-tools RHEL 8 4.18.0-513.5.1.el8_9
python3-perf RHEL 8 4.18.0-513.5.1.el8_9
kernel-modules RHEL 8 4.18.0-513.5.1.el8_9
kernel-zfcpdump RHEL 8 4.18.0-513.5.1.el8_9

red hat advisories RHSA-2023:7077 RHSA-2023:6583

kernel-rt SLE Micro 5.5 5.14.21-150500.13.109.1
kernel-source-rt SLE Micro 5.5 5.14.21-150500.13.109.1
kernel-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.133.1
kernel-source-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.133.1
kernel-64kb SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 5.14.21-150400.24.179.1
kernel-syms SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 5.14.21-150400.24.179.1
kernel-source SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 5.14.21-150400.24.179.1
kernel-default SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +7 more 5.14.21-150400.24.179.1

suse advisories SUSE-SU-2025:3761-1 SUSE-SU-2025:3716-1 SUSE-SU-2025:03628-1 SUSE-SU-2025:03615-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-50279 updated 2026-11-05 cvss 5.3

kernel: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

Red Hat Enterprise Linux 8 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +6 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
affected: no fix available “Fix deferred”
Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-513.5.1.el8_9, kernel-debuginfo-common-aarch64 4.18.0-513.5.1.el8_9, kernel-debuginfo-common-ppc64le 4.18.0-513.5.1.el8_9 Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-513.5.1.el8_9, kernel 4.18.0-513.5.1.el8_9, bpftool 4.18.0-513.5.1.el8_9, kernel-core 4.18.0-513.5.1.el8_9, kernel-tools 4.18.0-513.5.1.el8_9, python3-perf 4.18.0-513.5.1.el8_9, +15 more
fixed: vendor fix RHSA-2023:7077
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 10 kernel
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 d ago (2026-11-05)

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-125 Out-of-bounds Read

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2022-50279
NVD CVE-2022-50279

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary