CVE-2022-50044

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: start MHI channel after endpoit creation

MHI channel may generates event/interrupt right after enabling. It may leads to 2 race conditions issues.

Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check:

if (!qdev || mhi_res->transaction_status)
	return;

Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at this moment. In this situation qrtr-ns will be unable to enumerate services in device.

Such event may come at the moment after dev_set_drvdata() and before qrtr_endpoint_register(). In this case kernel will panic with accessing wrong pointer at qcom_mhi_qrtr_dl_callback():

rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr,
			mhi_res->bytes_xferd);

Because endpoint is not created yet.

So move mhi_prepare_for_transfer_autoqueue after endpoint creation to fix it.

This vulnerability is rated as Moderate severity rather than Important because exploitation requires specialized hardware utilizing the Qualcomm MHI bus and precise timing to trigger the race condition, substantially restricting real-world impact. The issue manifests during driver initialization when an event or interrupt is received before endpoint registration finishes, causing a kernel panic and subsequent denial of service. Typical Red Hat Enterprise Linux installations do not employ Qualcomm MHI modem devices, significantly reducing exposure for the vast majority of environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.