CVE-2022-49416

wifi: mac80211: fix use-after-free in chanctx code

State: Published
Severity: 8.8 High
Published: Feb 26, 2025
Updated: Aug 5, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix use-after-free in chanctx code

In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point.

However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 88cc8f963febe192d6ded9df7217f92f380b449aAffected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 4ba81e794f0fad6234f644c2da1ae14d5b95e1c4Affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 9f1e5cc85ad77e52f54049a94db0407445ae2a34Affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 265bec4779a38b65e86a25120370f200822dfa76Affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 6118bbdf69f4718b02d26bbcf2e497eb66004331Affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before b79110f2bf6022e60e590d2e094728a8eec3e79eAffected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 82c8e7bbdd06c7ed58e22450cc5b37f33a25bb2cAffected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6cAffected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 2965c4cdf7ad9ce0796fac5e57debb9519ea721eAffected
LinuxLinux	3.17Affected before 3.17Not affected 4.9.318 through 4.9.Not affected 4.14.283 through 4.14.Not affected 4.19.247 through 4.19.Not affected 5.4.198 through 5.4.Not affected 5.10.121 through 5.10.Not affected 5.15.46 through 5.15.Not affected 5.17.14 through 5.17.Not affected 5.18.3 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 88cc8f963febe192d6ded9df7217f92f380b449aAffected
5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 4ba81e794f0fad6234f644c2da1ae14d5b95e1c4Affected
5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 9f1e5cc85ad77e52f54049a94db0407445ae2a34Affected
5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 265bec4779a38b65e86a25120370f200822dfa76Affected
5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 6118bbdf69f4718b02d26bbcf2e497eb66004331Affected
5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before b79110f2bf6022e60e590d2e094728a8eec3e79eAffected
5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 82c8e7bbdd06c7ed58e22450cc5b37f33a25bb2cAffected
5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6cAffected
5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f to before 2965c4cdf7ad9ce0796fac5e57debb9519ea721eAffected

LinuxLinux

3.17Affected
before 3.17Not affected
4.9.318 through 4.9.*Not affected
4.14.283 through 4.14.*Not affected
4.19.247 through 4.19.*Not affected
5.4.198 through 5.4.*Not affected
5.10.121 through 5.10.*Not affected
5.15.46 through 5.15.*Not affected
5.17.14 through 5.17.*Not affected
5.18.3 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.