CVE-2022-50551 – This CVE describes a shift-out-of-bounds vulner... (How to Fix)

Q: What is the severity of CVE-2022-50551?

CVE-2022-50551 has a CVSS score of 7.1 (HIGH). This CVE describes a shift-out-of-bounds vulnerability in the brcmfmac WiFi driver in the Linux kernel. An attacker could potentially cause a kernel panic or denial of service by providing a maliciously large chiprev value. Systems using Broadcom brcmfmac WiFi drivers with vulnerable kernel versions are affected.

📋 TL;DR

This CVE describes a shift-out-of-bounds vulnerability in the brcmfmac WiFi driver in the Linux kernel. An attacker could potentially cause a kernel panic or denial of service by providing a maliciously large chiprev value. Systems using Broadcom brcmfmac WiFi drivers with vulnerable kernel versions are affected.

💻 Affected Systems

Products:

Linux kernel with brcmfmac driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using Broadcom brcmfmac WiFi drivers. The vulnerability triggers during USB WiFi device initialization or resume operations.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially requiring physical access to restart the system.

🟠

Likely Case

System crash or instability when connecting to malicious WiFi devices or processing corrupted firmware data.

🟢

If Mitigated

NULL pointer dereference handled gracefully by the driver, resulting in WiFi initialization failure but system remains stable.

🌐 Internet-Facing: LOW - Requires local access to USB/WiFi hardware or malicious peripheral device.

🏢 Internal Only: MEDIUM - Could be exploited by connecting malicious USB WiFi adapters or through compromised internal devices.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to provide malicious chiprev value, likely through USB device emulation or firmware manipulation. Found via syzkaller fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 0b12d2aa264bac35bff9b5399bb162262b2b8949, 1db036d13e10809943c2dce553e2fa7fc9c6cd80, 4c8fc44c44b97854623c56363c359f711fc0b887, 579c9b9838e8a73f6e93ddece07972c241514dcc, 5b06a8a25eba07628313aa3c5496522eff97be53

Vendor Advisory: https://git.kernel.org/stable/c/0b12d2aa264bac35bff9b5399bb162262b2b8949

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable brcmfmac driver

linux

Blacklist or disable the vulnerable brcmfmac driver module

echo 'blacklist brcmfmac' >> /etc/modprobe.d/blacklist-brcmfmac.conf
update-initramfs -u
reboot

Restrict USB device access

linux

Use udev rules to block unauthorized USB WiFi devices

echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="0a5c", ATTR{idProduct}=="*", MODE="0660", GROUP="trusted"' > /etc/udev/rules.d/99-broadcom-wifi.rules
udevadm control --reload-rules

🧯 If You Can't Patch

Disable automatic USB device mounting and WiFi hardware
Implement strict physical security controls for USB ports
Monitor system logs for kernel panic or brcmfmac errors

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if brcmfmac module is loaded: lsmod | grep brcmfmac && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and check dmesg for brcmfmac initialization without errors

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
UBSAN shift-out-of-bounds warnings in dmesg
brcmfmac driver failure during USB device initialization

Network Indicators:

Unexpected USB WiFi device connections
WiFi interface initialization failures

SIEM Query:

source="kernel" AND ("shift-out-of-bounds" OR "brcmfmac" AND (panic OR error))

📊 Metadata

CVE ID: CVE-2022-50551

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: October 7, 2025

Last Updated: February 5, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-50551, you might also want to check these: