---
id: CVE-2022-50871
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath11k: Fix qmi_msg_handler data structure initialization

  qmi_msg_handler is required to be null terminated by QMI module.
  There might be a case where a handler …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: ath11k: Fix qmi_msg_handler data structure initialization

  qmi_msg_handler is required to be null terminated by QMI module.
  There might be a case where a handler …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    d5d71de448f36e34592f7c81b5e300d3e8dbb735
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    a10e1530c424bb277b4edc7def0195857a548495
  - >-
    Linux >= d5c65159f2895379e11ca13f62feabe93278985d <
    ed3725e15a154ebebf44e0c34806c57525483f92
  - Linux 5.6
published: '2025-12-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:34.393'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-50871'
references:
  - url: 'https://git.kernel.org/stable/c/a10e1530c424bb277b4edc7def0195857a548495'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d5d71de448f36e34592f7c81b5e300d3e8dbb735'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ed3725e15a154ebebf44e0c34806c57525483f92'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00153
epssPercentile: 0.0437
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:32:41.532449Z'
ingestedAt: '2026-10-15T22:48:25.383Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: Fix qmi_msg_handler data structure initialization

qmi_msg_handler is required to be null terminated by QMI module.
There might be a case where a handler for a msg id is not present in the
handlers array which can lead to infinite loop while searching the handler
and therefore out of bound access in qmi_invoke_handler().
Hence update the initialization in qmi_msg_handler data structure.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01100-QCAHKSWPL_SILICONZ-1

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.