Security readout for executives and security teams
Plain-English summary
CVE-2022-50700 is a Linux kernel availability issue in the ath10k Wi-Fi driver on WCN3990 hardware. A rare hardware/driver timing problem can cause an SMMU fault and kernel panic. The evidence points to crash risk, not data theft or privilege escalation.
Executive priority
Prioritize where WCN3990-based Linux devices support business-critical connectivity or unattended operations. Broad emergency action is not supported by the sources, but affected fleets should receive normal kernel remediation because the failure mode is kernel panic.
Technical view
The ath10k driver may unmap and free a CE3 DMA source buffer immediately after a copy-complete interrupt, while WCN3990 hardware is still accessing it. The fix delays unmapping for WCN3990 CE3. The provided crash trace shows arm-smmu faults, remoteproc WLAN fatal errors, and kernel panic behavior.
Likely exposure
Exposure appears limited to Linux systems using Qualcomm WCN3990 Wi-Fi hardware with the ath10k driver and affected kernel versions. General Linux servers without this wireless chipset are unlikely to be exposed based on the source bundle.
Exploitation context
The source bundle does not show active exploitation, KEV listing, public exploit details, or remote attacker requirements. It describes a rare observed crash scenario during driver and hardware interaction, so treat this primarily as an availability and fleet-stability issue.
Researcher notes
The vulnerability is a race between CE3 copy-complete handling and DMA buffer lifetime on WCN3990. Evidence is strongest for the tested WCN3990 SNOC platform. CVSS, CWE, and exploitability details are absent, so avoid expanding affected scope beyond the provided kernel and hardware evidence.
Mitigation direction
- Identify systems using ath10k with Qualcomm WCN3990 wireless hardware.
- Update to a vendor kernel containing the referenced Linux stable fixes.
- Prioritize embedded, mobile, or edge devices where Wi-Fi loss affects operations.
- If patching is delayed, check vendor guidance for supported mitigations.
Validation and detection
- Confirm kernel source or package includes one referenced stable commit.
- Inventory devices for WCN3990 and ath10k driver usage.
- Review kernel logs for SMMU faults or WLAN remoteproc fatal errors.
- Check whether affected fleets run the kernel versions named in the CVE data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50700 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c4bedc3cda09d896c92adcdb6b62aa93b0c47a8aCVE reference, Linux
- https://git.kernel.org/stable/c/79a124b588aadb5a22695542778de14366ff3219CVE reference, Linux
- https://git.kernel.org/stable/c/acd4324e5f1f11351630234297f95076f0ac9a2fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.