CVE-2022-50044

net: qrtr: start MHI channel after endpoit creation

published June 18, 2025

CVSS
—
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: start MHI channel after endpoit creation

MHI channel may generates event/interrupt right after enabling.

It may leads to 2 race conditions issues.

1)

Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check:

if (!qdev || mhi_res->transaction_status)

return;

Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at

this moment. In this situation qrtr-ns will be unable to enumerate

services in device.

---------------------------------------------------------------

2)

Such event may come at the moment after dev_set_drvdata() and

before qrtr_endpoint_register(). In this case kernel will panic with

accessing wrong pointer at qcom_mhi_qrtr_dl_callback():

rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr,

mhi_res->bytes_xferd);

Because endpoint is not created yet.

--------------------------------------------------------------

So move mhi_prepare_for_transfer_autoqueue after endpoint creation

to fix it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00137 · 2.8th percentile
Published
2025-06-18T11:01Z
EPSS history
Timeline
  • 18 JUN 11:01Z
    net: qrtr: start MHI channel after endpoit creation
    cvelistv5