LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50164: wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue After successfull station association, if station queues are disabled for some reason, the related lists are not emptied. So if some new element is added to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old one and produce a BUG like this: [ 46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388). [ 46.535283] ------------[ cut here ]------------ [ 46.535284] kernel BUG at lib/list_debug.c:26! [ 46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1 [ 46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN , BIOS A07 08/24/2012 [ 46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f [ 46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1 [ 46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286 [ 46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000 [ 46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff [ 46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666 [ 46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388 [ 46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0 [ 46.666108] FS: 00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000 [ 46.674331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0 [ 46.687422] Call Trace: [ 46.689906] <TASK> [ 46.691950] iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm] [ 46.697601] ieee80211_queue_skb+0x4b3/0x720 [mac80211] [ 46.702973] ? sta_info_get+0x46/0x60 [mac80211] [ 46.707703] ieee80211_tx+0xad/0x110 [mac80211] [ 46.712355] __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211] ... In order to avoid this problem, we must also remove the related lists when station queues are disabled.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50164 is a Linux kernel Wi-Fi driver bug that can corrupt an internal list and hit a kernel BUG. The available sources point to reliability and denial-of-service risk on systems using the Intel iwlwifi/mvm driver, not confirmed remote compromise.

Executive priority

Treat as a targeted kernel reliability fix for Wi-Fi-enabled Linux endpoints. Prioritize patching managed laptops and wireless systems, but do not treat it as internet-wide emergency exposure based on the provided evidence.

Technical view

In iwlwifi mvm, station queues disabled after association could leave related lists populated. Later iwl_mvm_mac_wake_tx_queue could add a matching entry again, causing double list_add corruption and a kernel BUG in list_debug.c. The fix removes related lists when station queues are disabled.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel versions with Intel iwlwifi/mvm Wi-Fi in use. Servers without this wireless driver or hardware are less likely exposed. The provided version data is incomplete and should be checked against distribution kernel advisories.

Exploitation context

The bundle does not cite active exploitation, and KEV is false. Sources show a kernel BUG triggered around Wi-Fi station association and queue state handling. They do not establish exploit prerequisites, remote reachability, privilege impact, or weaponized abuse.

Researcher notes

Evidence supports a list lifecycle bug in iwlwifi/mvm queue handling. CVSS, CWE, and exploitation details are absent. Analysis should focus on driver presence, affected kernel lineage, distro backports, and crash telemetry rather than assuming code execution.

Mitigation direction

  • Upgrade to a kernel build containing the listed stable iwlwifi/mvm fixes.
  • Prioritize Linux laptops, workstations, and edge systems using Intel iwlwifi Wi-Fi.
  • Check distribution vendor advisories for fixed package versions and backports.
  • If upgrade is delayed, follow vendor guidance for reducing iwlwifi exposure.
  • Track crashes referencing iwl_mvm_mac_wake_tx_queue or list_add corruption.

Validation and detection

  • Inventory Linux kernel versions across Wi-Fi-enabled endpoints.
  • Identify systems loading iwlwifi and iwlmvm kernel modules.
  • Compare installed kernels with distribution advisories and listed stable commits.
  • Review logs for kernel BUG traces involving iwl_mvm_mac_wake_tx_queue.
  • Confirm patched systems no longer report the affected stack trace.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50164 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcfbc6c4c5b91c7725ef14465b98ac347d31f2334, cfbc6c4c5b91c7725ef14465b98ac347d31f2334, cfbc6c4c5b91c7725ef14465b98ac347d31f2334, cfbc6c4c5b91c7725ef14465b98ac347d31f2334, cfbc6c4c5b91c7725ef14465b98ac347d31f2334, cfbc6c4c5b91c7725ef14465b98ac347d31f2334unaffected
LinuxLinux5.1, 0, 5.4.211, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.