wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()
Published Dec 30, 2025
5.1
MEDIUMCVSS 3.1
EPSS 0.18%
Description
Don't dereference "sar_root" after it has been freed.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 6.0StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<6.0
- Version 6.0.3StatusunaffectedConstraints<=6.0.*
- Version 6.1StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
No data.
No data.
Red Hat Enterprise Linux 10
kernel
Not affected
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Fix deferred
Red Hat Enterprise Linux 8
kernel-rt
Fix deferred
Red Hat Enterprise Linux 9
kernel
Fix deferred
Red Hat Enterprise Linux 9
kernel-rt
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
A use-after-free issue exists in mt7921_acpi_read() where sar_root->package.count was dereferenced after sar_root had already been freed. Triggering it typically requires privileged control over ACPI/firmware-provided data (or equivalent device/boot-time control), making real-world exploitation unlikely for unprivileged users. The most realistic outcome is driver misbehavior or a crash in debug/sanitized builds. The bug is a read-after-free that only affects a return value.
References (7)
- https://access.redhat.com/security/cve/CVE-2022-50852 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2426242 Issue Tracking
- https://git.kernel.org/stable/c/3ed0b382cb36f6dac9f93b3a5533cfcd699409a5
- https://git.kernel.org/stable/c/e7de4b4979bd8d313ec837931dde936653ca82ea
- https://lore.kernel.org/linux-cve-announce/2025123045-CVE-2022-50852-978e@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2022-50852
- https://www.cve.org/CVERecord?id=CVE-2022-50852
Change history (0)
No recorded changes yet.