CVE-2022-50408

A use after free exists in the wifi module of the linux kernel in the function brcmf_netdev_start_xmit(),thereby leading to damage to system availability and integrity.

A Use-After-Free vulnerability was found in brcmf_netdev_start_xmit() in the Broadcom brcmfmac driver. The function updated ndev->stats.tx_bytes after calling brcmf_proto_tx_queue_data(), which may complete asynchronously and free the skb object before accessing it. The patch stores skb->len in a local variable before the transmission call to prevent dereferencing freed memory. Privilege required is low (PR:L) since the issue is triggered during normal packet transmission from a network interface, accessible to local processes using networking APIs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module brcmfmac from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.