Security readout for executives and security teams
Plain-English summary
A Linux kernel bug in the Wi-Fi driver for MediaTek MT7921 wireless chips causes the system to leak a small amount of memory each time a particular driver function runs. Over time or under repeated triggering, this can degrade system stability on affected Linux laptops and devices. There is no remote attack path and no sign of exploitation in the wild.
Executive priority
Low priority. Schedule with routine kernel patching cycles for Linux systems using MediaTek MT7921 Wi-Fi hardware. No evidence of active exploitation and impact is limited to local availability on affected hosts.
Technical view
CVE-2022-50424 is a CWE-401 memory leak in the Linux kernel mt76 driver for the MediaTek MT7921 Wi-Fi chipset. The function mt7921_check_offload_capability() fails to release the firmware buffer pointed to by "fw" when it goes out of scope, leaking allocated storage. CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/C:N/I:N/A:H), reflecting local-only access with availability impact only.
Likely exposure
Limited to Linux systems running affected kernel versions (through 6.2.3 and the 6.3 line prior to fix) that load the mt76/mt7921 Wi-Fi driver, typically laptops, embedded devices, or workstations using MediaTek MT7921 wireless chipsets. Servers and headless systems without this hardware are not exposed.
Exploitation context
No public exploit, proof-of-concept, or active exploitation is referenced in the cited sources, and the CVE is not listed in CISA KEV. Triggering the leak requires local access to a host with the vulnerable MediaTek MT7921 Wi-Fi driver and the ability to invoke driver initialization paths repeatedly.
Researcher notes
Root cause is a missing release of the loaded firmware blob (variable "fw") on an exit path in mt7921_check_offload_capability(), flagged by Coverity (ID 1527806) and classed as CWE-401. CVSS vector AV:L/AC:L/PR:L/UI:N/C:N/I:N/A:H reflects local trigger with availability-only impact. Fix commits are ead3cffd7510 and 47180ecf4541 on kernel.org stable. Affected range per the bundle: Linux 6.2 through 6.2.3 and 6.3 prior to fix; sources do not enumerate every distro backport, so check vendor trackers for downstream status.
Mitigation direction
- Update affected Linux kernels to a version that includes the upstream mt7921 fix referenced in the kernel.org commits.
- Track distribution vendor advisories (Debian, Ubuntu, RHEL, SUSE) for backported stable-tree patches covering this CVE.
- On systems without MediaTek MT7921 hardware, confirm the mt7921 module is not loaded and deprioritize.
- Apply standard local-access hardening: limit untrusted local users on devices using the affected wireless driver.
Validation and detection
- Identify Linux hosts running kernels in the affected range (through 6.2.3 and pre-fix 6.3) using inventory or `uname -r`.
- Check whether the mt7921e/mt7921 module is present and loaded with `lsmod | grep mt7921`.
- Cross-reference installed kernel package version against vendor security advisories citing CVE-2022-50424.
- After patching, confirm the running kernel includes commits ead3cffd7510 or 47180ecf4541 via distro changelog.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50424 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.