CVE-2022-49942

MEDIUM EPSS 11.3%
Published Jun 18, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jun 18, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa().

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
11.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 10

VendorProductVersionRange
linuxlinux_kernel*≥3.13  –  <4.9.328
linuxlinux_kernel*≥4.10  –  <4.14.293
linuxlinux_kernel*≥4.15  –  <4.19.258
linuxlinux_kernel*≥4.20  –  <5.4.213
linuxlinux_kernel*≥5.5  –  <5.10.142
linuxlinux_kernel*≥5.11  –  <5.15.66
linuxlinux_kernel*≥5.16  –  <5.19.8
linuxlinux_kernel6.0any
linuxlinux_kernel6.0any
linuxlinux_kernel6.0any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1691a48aef0a82d1754b9853dae7e3f5cacdf70b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/552ba102a6898630a7d16887f29e606d6fabe508
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/66689c5c02acd4d76c28498fe220998610aec61e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/864e280cb3a9a0f5212b16ef5057c4e692f7039d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cdb9a8da9b84800eb15506cd9363cf0cf059e677
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d9eb37db6a28b59a95a3461450ee209654c5f95b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/dd649b49219a0388cc10fc40e4c2ea681566a780
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/1691a48aef0a82d1754b9853dae7e3f5cacdf70b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/552ba102a6898630a7d16887f29e606d6fabe508
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/66689c5c02acd4d76c28498fe220998610aec61e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/864e280cb3a9a0f5212b16ef5057c4e692f7039d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cdb9a8da9b84800eb15506cd9363cf0cf059e677
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d9eb37db6a28b59a95a3461450ee209654c5f95b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/dd649b49219a0388cc10fc40e4c2ea681566a780
    Patch