CVE-2022-48705— wifi: mt76: mt7921e: fix crash in chip reset fail
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-48705
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wifi: mt76: mt7921e: fix crash in chip reset fail
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix crash in chip reset fail In case of drv own fail in reset, we may need to run mac_reset several times. The sequence would trigger system crash as the log below. Because we do not re-enable/schedule "tx_napi" before disable it again, the process would keep waiting for state change in napi_diable(). To avoid the problem and keep status synchronize for each run, goto final resource handling if drv own failed. [ 5857.353423] mt7921e 0000:3b:00.0: driver own failed [ 5858.433427] mt7921e 0000:3b:00.0: Timeout for driver own [ 5859.633430] mt7921e 0000:3b:00.0: driver own failed [ 5859.633444] ------------[ cut here ]------------ [ 5859.633446] WARNING: CPU: 6 at kernel/kthread.c:659 kthread_park+0x11d [ 5859.633717] Workqueue: mt76 mt7921_mac_reset_work [mt7921_common] [ 5859.633728] RIP: 0010:kthread_park+0x11d/0x150 [ 5859.633736] RSP: 0018:ffff8881b676fc68 EFLAGS: 00010202 ...... [ 5859.633766] Call Trace: [ 5859.633768] <TASK> [ 5859.633771] mt7921e_mac_reset+0x176/0x6f0 [mt7921e] [ 5859.633778] mt7921_mac_reset_work+0x184/0x3a0 [mt7921_common] [ 5859.633785] ? mt7921_mac_set_timing+0x520/0x520 [mt7921_common] [ 5859.633794] ? __kasan_check_read+0x11/0x20 [ 5859.633802] process_one_work+0x7ee/0x1320 [ 5859.633810] worker_thread+0x53c/0x1240 [ 5859.633818] kthread+0x2b8/0x370 [ 5859.633824] ? process_one_work+0x1320/0x1320 [ 5859.633828] ? kthread_complete_and_exit+0x30/0x30 [ 5859.633834] ret_from_fork+0x1f/0x30 [ 5859.633842] </TASK>
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于芯片重置失败时存在安全漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-48705
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-48705
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-05-03 · 25 CVEs total
| CVE-2022-48693 | soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs | |
| CVE-2022-48704 | drm/radeon: add a force flush to delay work when radeon | |
| CVE-2022-48695 | scsi: mpt3sas: Fix use-after-free warning | |
| CVE-2022-48690 | ice: Fix DMA mappings leak | |
| CVE-2022-48703 | thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR | |
| CVE-2022-48702 | ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() | |
| CVE-2022-48701 | ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() | |
| CVE-2022-48699 | sched/debug: fix dentry leak in update_sched_domain_debugfs | |
| CVE-2022-48698 | drm/amd/display: fix memory leak when using debugfs_lookup() | |
| CVE-2022-48697 | nvmet: fix a use-after-free | |
| CVE-2022-48696 | regmap: spi: Reserve space for register address/padding | |
| CVE-2022-48694 | RDMA/irdma: Fix drain SQ hang with no completion | |
| CVE-2022-48670 | peci: cpu: Fix use-after-free in adev_release() | |
| CVE-2022-48692 | RDMA/srp: Set scmnd->result only when scmnd is not NULL | |
| CVE-2022-48691 | netfilter: nf_tables: clean up hook list when offload flags check fails | |
| CVE-2022-48689 | tcp: TX zerocopy should not sense pfmemalloc status | |
| CVE-2022-48688 | i40e: Fix kernel crash during module removal | |
| CVE-2022-48687 | ipv6: sr: fix out-of-bounds read when setting HMAC data. | |
| CVE-2022-48686 | nvme-tcp: fix UAF when detecting digest errors | |
| CVE-2022-48675 | IB/core: Fix a nested dead lock as part of ODP flow |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2022-48705
No comments yet