{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49479", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T02:08:31.581Z", "datePublished": "2025-02-26T02:13:20.011Z", "dateUpdated": "2026-08-05T08:55:21.441Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:55:21.441Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: fix tx status related use-after-free race on station removal\n\nThere is a small race window where ongoing tx activity can lead to a skb\ngetting added to the status tracking idr after that idr has already been\ncleaned up, which will keep the wcid linked in the status poll list.\nFix this by only adding status skbs if the wcid pointer is still assigned\nin dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The bug is in the MediaTek mt76 WiFi TX-status path during station removal; mt76 commonly runs as an AP (OpenWrt routers, hotspots) where an on-link WiFi peer can force disassoc/deauth and race concurrent TX. This is same-segment wireless reachability, not internet-remote (N) or host-local-only (L).\nAC:L - The attacker can drive both sides of the race—generate traffic that queues TX-status skbs and force station removal via disconnect/deauth—so success does not depend on conditions outside their control. Per guidance, attacker-controlled races and UAFs score AC:L.\nPR:N - Station removal and in-flight TX are reachable from the wireless medium (peer deauth/disassoc or a client leaving) with no privileges on the host kernel. No CAP_NET_ADMIN or local account is required in the AP/hotspot worst case.\nUI:N - Exploitation needs no victim user action beyond normal network operation; the attacker triggers disconnect and concurrent TX themselves.\nS:U - This is in-kernel memory corruption/privilege escalation within the host kernel’s security authority, not a VM/IOMMU/sandbox boundary crossing.\nC:H - The race re-links a freed wcid into the TX-status poll list (use-after-free); UAF enables control of freed object contents and thus arbitrary read primitives.\nI:H - The same wcid UAF is heap memory corruption exploitable for arbitrary write / control-flow hijack via status-list processing after station free.\nA:H - Use-after-free on the status poll path can oops/panic the kernel even without full exploitation, so availability impact is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/mediatek/mt76/mac80211.c", "drivers/net/wireless/mediatek/mt76/tx.c" ], "versions": [ { "version": "bd1e3e7b693c17a04e7d2bd9119daa482b7c7720", "lessThan": "ef7f9f894cfd0b2e471206409a529af4a26ddd55", "status": "affected", "versionType": "git" }, { "version": "bd1e3e7b693c17a04e7d2bd9119daa482b7c7720", "lessThan": "ddd426d72aca4054045a9bd3b80a4ce1d398f11f", "status": "affected", "versionType": "git" }, { "version": "bd1e3e7b693c17a04e7d2bd9119daa482b7c7720", "lessThan": "fcfe1b5e162bf473c1d47760962cec8523c00466", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/mediatek/mt76/mac80211.c", "drivers/net/wireless/mediatek/mt76/tx.c" ], "versions": [ { "version": "5.16", "status": "affected" }, { "version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver" }, { "version": "5.17.14", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18.3", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.17.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.18.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "5.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ef7f9f894cfd0b2e471206409a529af4a26ddd55" }, { "url": "https://git.kernel.org/stable/c/ddd426d72aca4054045a9bd3b80a4ce1d398f11f" }, { "url": "https://git.kernel.org/stable/c/fcfe1b5e162bf473c1d47760962cec8523c00466" } ], "title": "mt76: fix tx status related use-after-free race on station removal", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2022-49479", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-02-27T18:15:50.287677Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T18:22:32.261Z" } } ] } }