Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory leak in the mt76x02u USB wireless driver path. When a USB message send fails, the kernel could fail to release an allocated network buffer. Business risk appears limited from the supplied evidence, but affected systems should receive normal kernel updates.
Executive priority
Handle through routine kernel patch management unless the organization relies heavily on affected USB wireless adapters. There is no supplied evidence of active exploitation, no CVSS score, and no named remote compromise impact.
Technical view
The flaw is in __mt76x02u_mcu_send_msg in the Linux mt76 driver. If mt76u_bulk_msg fails, the skb was not freed, creating a possible memory leak. The referenced Linux stable commits resolve the issue by freeing the skb on that failure path.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with the mt76x02u USB wireless driver in use. Systems without that driver or hardware path are less likely to be affected. The source bundle does not identify specific distributions or appliances.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. It also does not describe a practical attack path. Based only on the sources, this should be treated as a reliability and resource-exhaustion concern until vendor advisories say otherwise.
Researcher notes
The record is sparse: no CVSS, CWE, distro matrix, or exploitability analysis is provided. The root cause and fix are clear in the kernel description, but real-world impact depends on driver reachability and failure frequency in affected deployments.
Mitigation direction
- Apply vendor Linux kernel updates containing the referenced stable fixes.
- Prioritize systems using mt76x02u USB wireless adapters or mt76 drivers.
- Check distribution advisories for backported fixes and affected package versions.
- Keep kernel update testing aligned with normal device-driver regression coverage.
Validation and detection
- Inventory Linux kernel versions against the affected and fixed version guidance.
- Confirm whether mt76x02u or related mt76 USB wireless support is present.
- Verify updated kernel packages include the relevant stable commit fixes.
- Review monitoring for unusual memory growth on affected wireless systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50172 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3ad958bc488e3ecb0207d31621c00efb86f17482CVE reference, Linux
- https://git.kernel.org/stable/c/f1609c4f4a21777e081b36596224802b85052ad9CVE reference, Linux
- https://git.kernel.org/stable/c/da1ab462b96c5d47a0755aec957bae3d685538c5CVE reference, Linux
- https://git.kernel.org/stable/c/2f53ba46d8c97aca681adbe5098e1f84580c446dCVE reference, Linux
- https://git.kernel.org/stable/c/cffd93411575afd987788e2ec3cb8eaff70f0215CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.