CVE-2022-50355 (GCVE-0-2022-50355)

Vulnerability from cvelistv5 – Published: 2025-09-17 14:56 – Updated: 2026-08-05 08:58
VLAI
Title
staging: vt6655: fix some erroneous memory clean-up loops
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: vt6655: fix some erroneous memory clean-up loops In some initialization functions of this driver, memory is allocated with 'i' acting as an index variable and increasing from 0. The commit in "Fixes" introduces some clean-up codes in case of allocation failure, which free memory in reverse order with 'i' decreasing to 0. However, there are some problems: - The case i=0 is left out. Thus memory is leaked. - In case memory allocation fails right from the start, the memory freeing loops will start with i=-1 and invalid memory locations will be accessed. One of these loops has been fixed in commit c8ff91535880 ("staging: vt6655: fix potential memory leak"). Fix the remaining erroneous loops.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:31 UTC
CWE
  • CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5341ee0adb17d12a96dc5344e0d267cd12b52135 , < 637672a71f5016a40b0a6c0f3c8ad25eacedc8c3 (git)
Affected: 5341ee0adb17d12a96dc5344e0d267cd12b52135 , < 88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0 (git)
Affected: 5341ee0adb17d12a96dc5344e0d267cd12b52135 , < 95ac62e8545be2b0a8cae0beef7c682e2e470e48 (git)
Affected: 5341ee0adb17d12a96dc5344e0d267cd12b52135 , < f19e5b7df54590c831f350381963f25585c8f7d5 (git)
Affected: 5341ee0adb17d12a96dc5344e0d267cd12b52135 , < a9e9806d1c315bc50dce05479a079b9a104474b8 (git)
Affected: 5341ee0adb17d12a96dc5344e0d267cd12b52135 , < ed11b73c963292e7b49c0f37025c58ed3b7921d6 (git)
Affected: 5341ee0adb17d12a96dc5344e0d267cd12b52135 , < 2a2db520e3ca5aafba7c211abfd397666c9b5f9d (git)
Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 4.19.262 , ≤ 4.19.* (semver)
Unaffected: 5.4.220 , ≤ 5.4.* (semver)
Unaffected: 5.10.150 , ≤ 5.10.* (semver)
Unaffected: 5.15.75 , ≤ 5.15.* (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50355",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:31:51.758929Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:33:00.943Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/vt6655/device_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "637672a71f5016a40b0a6c0f3c8ad25eacedc8c3",
              "status": "affected",
              "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
              "versionType": "git"
            },
            {
              "lessThan": "88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0",
              "status": "affected",
              "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
              "versionType": "git"
            },
            {
              "lessThan": "95ac62e8545be2b0a8cae0beef7c682e2e470e48",
              "status": "affected",
              "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
              "versionType": "git"
            },
            {
              "lessThan": "f19e5b7df54590c831f350381963f25585c8f7d5",
              "status": "affected",
              "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
              "versionType": "git"
            },
            {
              "lessThan": "a9e9806d1c315bc50dce05479a079b9a104474b8",
              "status": "affected",
              "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
              "versionType": "git"
            },
            {
              "lessThan": "ed11b73c963292e7b49c0f37025c58ed3b7921d6",
              "status": "affected",
              "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
              "versionType": "git"
            },
            {
              "lessThan": "2a2db520e3ca5aafba7c211abfd397666c9b5f9d",
              "status": "affected",
              "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/vt6655/device_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.262",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.262",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.220",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vt6655: fix some erroneous memory clean-up loops\n\nIn some initialization functions of this driver, memory is allocated with\n\u0027i\u0027 acting as an index variable and increasing from 0. The commit in\n\"Fixes\" introduces some clean-up codes in case of allocation failure,\nwhich free memory in reverse order with \u0027i\u0027 decreasing to 0. However,\nthere are some problems:\n  - The case i=0 is left out. Thus memory is leaked.\n  - In case memory allocation fails right from the start, the memory\n    freeing loops will start with i=-1 and invalid memory locations will\n    be accessed.\n\nOne of these loops has been fixed in commit c8ff91535880 (\"staging:\nvt6655: fix potential memory leak\"). Fix the remaining erroneous loops."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only when bringing up the vt6655 mac80211 interface (SIOCSIFFLAGS/ip link set up \u2192 ieee80211_open \u2192 drv_start \u2192 vnt_start \u2192 device_init_rd0/rd1/td1_ring), which is local driver initialization\u2014not packet parsing or adjacent-link frame injection.\nAC:L - A local attacker can induce memory pressure (memcg/mmap) so the first kzalloc or device_alloc_rx_buf in ring init fails after device_init_rings succeeds, then deterministically hit the broken while (--i) path; no race or attacker-uncontrollable layout is required.\nPR:L - Triggering vnt_start requires CAP_NET_ADMIN to set IFF_UP, but in realistic deployments (NetworkManager/polkit seat policies, delegated net admin) an unprivileged local user can enable the wireless interface; per guidance when uncertain this is scored Low rather than High.\nUI:N - The attacker brings the interface up and forces the allocation-failure cleanup themselves; no separate victim mount, click, or other interactive action is required.\nS:U - Impact is host-kernel heap corruption inside the staging PCI WiFi driver under the same OS authority, with no VM escape, IOMMU bypass, or other security-boundary crossing.\nC:H - On i==0 failure, while (--i) indexes aRD1Ring[-1]/apTD1Rings[-1] into the previously initialized adjacent DMA ring and frees live rd_info/td_info (double-free), and continues further OOB\u2014classic heap corruption enabling arbitrary kernel read primitives.\nI:H - The same OOB/double-free of descriptor side objects (kfree, dma_unmap, kfree_skb on adjacent or garbage pointers) is exploitable for heap corruption and control-flow hijacking beyond a pure crash.\nA:H - The buggy loop from i==0 decrements indefinitely through invalid indices and frees garbage/adjacent objects, causing kernel oops/panic even without full exploitation; any such crash is Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:21.802Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/637672a71f5016a40b0a6c0f3c8ad25eacedc8c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/95ac62e8545be2b0a8cae0beef7c682e2e470e48"
        },
        {
          "url": "https://git.kernel.org/stable/c/f19e5b7df54590c831f350381963f25585c8f7d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9e9806d1c315bc50dce05479a079b9a104474b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed11b73c963292e7b49c0f37025c58ed3b7921d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a2db520e3ca5aafba7c211abfd397666c9b5f9d"
        }
      ],
      "title": "staging: vt6655: fix some erroneous memory clean-up loops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50355",
    "datePublished": "2025-09-17T14:56:08.356Z",
    "dateReserved": "2025-09-17T14:53:06.993Z",
    "dateUpdated": "2026-08-05T08:58:21.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50355",
      "date": "2026-10-02",
      "epss": "0.00215",
      "percentile": "0.10771"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/vt6655/device_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "637672a71f5016a40b0a6c0f3c8ad25eacedc8c3",
                    "status": "affected",
                    "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0",
                    "status": "affected",
                    "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "95ac62e8545be2b0a8cae0beef7c682e2e470e48",
                    "status": "affected",
                    "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f19e5b7df54590c831f350381963f25585c8f7d5",
                    "status": "affected",
                    "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a9e9806d1c315bc50dce05479a079b9a104474b8",
                    "status": "affected",
                    "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ed11b73c963292e7b49c0f37025c58ed3b7921d6",
                    "status": "affected",
                    "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a2db520e3ca5aafba7c211abfd397666c9b5f9d",
                    "status": "affected",
                    "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/vt6655/device_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.18"
                  },
                  {
                    "lessThan": "4.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.262",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.220",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.150",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2F40133E-F55D-4416-A957-900509BE4775",
                    "versionEndExcluding": "4.19.262",
                    "versionStartIncluding": "4.18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "125F7133-B3B7-4175-8CF3-FF0845483254",
                    "versionEndExcluding": "5.4.220",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C495821C-2A71-4F09-BED8-6A6EB4C9BA27",
                    "versionEndExcluding": "5.10.150",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D945F46-F32F-4C09-8400-C3477E22A9FB",
                    "versionEndExcluding": "5.15.75",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "19B4C3A4-E5C3-41DC-BB14-BE72858E7D35",
                    "versionEndExcluding": "5.19.17",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5BCD8201-B847-4442-B894-70D430128DEF",
                    "versionEndExcluding": "6.0.3",
                    "versionStartIncluding": "6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vt6655: fix some erroneous memory clean-up loops\n\nIn some initialization functions of this driver, memory is allocated with\n\u0027i\u0027 acting as an index variable and increasing from 0. The commit in\n\"Fixes\" introduces some clean-up codes in case of allocation failure,\nwhich free memory in reverse order with \u0027i\u0027 decreasing to 0. However,\nthere are some problems:\n  - The case i=0 is left out. Thus memory is leaked.\n  - In case memory allocation fails right from the start, the memory\n    freeing loops will start with i=-1 and invalid memory locations will\n    be accessed.\n\nOne of these loops has been fixed in commit c8ff91535880 (\"staging:\nvt6655: fix potential memory leak\"). Fix the remaining erroneous loops."
          }
        ],
        "id": "CVE-2022-50355",
        "lastModified": "2026-08-04T10:18:12.540",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-50355",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:31:51.758929Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-17T15:15:34.150",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2a2db520e3ca5aafba7c211abfd397666c9b5f9d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/637672a71f5016a40b0a6c0f3c8ad25eacedc8c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/95ac62e8545be2b0a8cae0beef7c682e2e470e48"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a9e9806d1c315bc50dce05479a079b9a104474b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ed11b73c963292e7b49c0f37025c58ed3b7921d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f19e5b7df54590c831f350381963f25585c8f7d5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:31:52+00:00",
      "cve": "CVE-2022-50355",
      "id": "CVE-2022-50355",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: staging: vt6655: fix some erroneous memory clean-up loops",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50355.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-50355",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-14T18:31:51.758929Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-401",
                    "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-14T18:31:47.624Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/staging/vt6655/device_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "637672a71f5016a40b0a6c0f3c8ad25eacedc8c3",
                  "status": "affected",
                  "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                  "versionType": "git"
                },
                {
                  "lessThan": "88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0",
                  "status": "affected",
                  "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                  "versionType": "git"
                },
                {
                  "lessThan": "95ac62e8545be2b0a8cae0beef7c682e2e470e48",
                  "status": "affected",
                  "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                  "versionType": "git"
                },
                {
                  "lessThan": "f19e5b7df54590c831f350381963f25585c8f7d5",
                  "status": "affected",
                  "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                  "versionType": "git"
                },
                {
                  "lessThan": "a9e9806d1c315bc50dce05479a079b9a104474b8",
                  "status": "affected",
                  "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                  "versionType": "git"
                },
                {
                  "lessThan": "ed11b73c963292e7b49c0f37025c58ed3b7921d6",
                  "status": "affected",
                  "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                  "versionType": "git"
                },
                {
                  "lessThan": "2a2db520e3ca5aafba7c211abfd397666c9b5f9d",
                  "status": "affected",
                  "version": "5341ee0adb17d12a96dc5344e0d267cd12b52135",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/staging/vt6655/device_main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.18"
                },
                {
                  "lessThan": "4.18",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.262",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.220",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.150",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.75",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.19.*",
                  "status": "unaffected",
                  "version": "5.19.17",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.0.*",
                  "status": "unaffected",
                  "version": "6.0.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.1",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.262",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.220",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.150",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.75",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19.17",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0.3",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1",
                      "versionStartIncluding": "4.18",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vt6655: fix some erroneous memory clean-up loops\n\nIn some initialization functions of this driver, memory is allocated with\n\u0027i\u0027 acting as an index variable and increasing from 0. The commit in\n\"Fixes\" introduces some clean-up codes in case of allocation failure,\nwhich free memory in reverse order with \u0027i\u0027 decreasing to 0. However,\nthere are some problems:\n  - The case i=0 is left out. Thus memory is leaked.\n  - In case memory allocation fails right from the start, the memory\n    freeing loops will start with i=-1 and invalid memory locations will\n    be accessed.\n\nOne of these loops has been fixed in commit c8ff91535880 (\"staging:\nvt6655: fix potential memory leak\"). Fix the remaining erroneous loops."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The flaw is reached only when bringing up the vt6655 mac80211 interface (SIOCSIFFLAGS/ip link set up \u2192 ieee80211_open \u2192 drv_start \u2192 vnt_start \u2192 device_init_rd0/rd1/td1_ring), which is local driver initialization\u2014not packet parsing or adjacent-link frame injection.\nAC:L - A local attacker can induce memory pressure (memcg/mmap) so the first kzalloc or device_alloc_rx_buf in ring init fails after device_init_rings succeeds, then deterministically hit the broken while (--i) path; no race or attacker-uncontrollable layout is required.\nPR:L - Triggering vnt_start requires CAP_NET_ADMIN to set IFF_UP, but in realistic deployments (NetworkManager/polkit seat policies, delegated net admin) an unprivileged local user can enable the wireless interface; per guidance when uncertain this is scored Low rather than High.\nUI:N - The attacker brings the interface up and forces the allocation-failure cleanup themselves; no separate victim mount, click, or other interactive action is required.\nS:U - Impact is host-kernel heap corruption inside the staging PCI WiFi driver under the same OS authority, with no VM escape, IOMMU bypass, or other security-boundary crossing.\nC:H - On i==0 failure, while (--i) indexes aRD1Ring[-1]/apTD1Rings[-1] into the previously initialized adjacent DMA ring and frees live rd_info/td_info (double-free), and continues further OOB\u2014classic heap corruption enabling arbitrary kernel read primitives.\nI:H - The same OOB/double-free of descriptor side objects (kfree, dma_unmap, kfree_skb on adjacent or garbage pointers) is exploitable for heap corruption and control-flow hijacking beyond a pure crash.\nA:H - The buggy loop from i==0 decrements indefinitely through invalid indices and frees garbage/adjacent objects, causing kernel oops/panic even without full exploitation; any such crash is Availability High."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:58:21.802Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/637672a71f5016a40b0a6c0f3c8ad25eacedc8c3"
            },
            {
              "url": "https://git.kernel.org/stable/c/88b9cc60f26e8a05d1ddbddf91b09ca2915f20e0"
            },
            {
              "url": "https://git.kernel.org/stable/c/95ac62e8545be2b0a8cae0beef7c682e2e470e48"
            },
            {
              "url": "https://git.kernel.org/stable/c/f19e5b7df54590c831f350381963f25585c8f7d5"
            },
            {
              "url": "https://git.kernel.org/stable/c/a9e9806d1c315bc50dce05479a079b9a104474b8"
            },
            {
              "url": "https://git.kernel.org/stable/c/ed11b73c963292e7b49c0f37025c58ed3b7921d6"
            },
            {
              "url": "https://git.kernel.org/stable/c/2a2db520e3ca5aafba7c211abfd397666c9b5f9d"
            }
          ],
          "title": "staging: vt6655: fix some erroneous memory clean-up loops",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-50355",
        "datePublished": "2025-09-17T14:56:08.356Z",
        "dateReserved": "2025-09-17T14:53:06.993Z",
        "dateUpdated": "2026-08-05T08:58:21.802Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.