CVE-2022-49934

wifi: mac80211: Fix UAF in ieee80211_scan_rx()

State: Published
Severity: 8.8 High
Published: Jun 18, 2025
Updated: Aug 5, 2026
Reserved: May 1, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Fix UAF in ieee80211_scan_rx()

ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req.

Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done().

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 6eb181a64fdabf10be9e54de728876667da20255Affected 6ea0a69ca21bbddab5b3979c2190013b0263e749 to before e0ff39448cea654843744c72c6780293c5082cb1Affected 6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 78a07732fbb0934d14827d8f09b9aa6a49ee1aa9Affected 6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2dAffected 6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 4abc8c07a065ecf771827bde3c63fbbe4aa0c08bAffected 6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 5d20c6f932f2758078d0454729129c894fe353e7Affected 6ea0a69ca21bbddab5b3979c2190013b0263e749 to before c0445feb80a4d0854898118fa01073701f8d356bAffected 6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 60deb9f10eec5c6a20252ed36238b55d8b614a2cAffected
LinuxLinux	3.19Affected before 3.19Not affected 4.9.330 through 4.9.Not affected 4.14.295 through 4.14.Not affected 4.19.260 through 4.19.Not affected 5.4.215 through 5.4.Not affected 5.10.142 through 5.10.Not affected 5.15.66 through 5.15.Not affected 5.19.8 through 5.19.*Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 6eb181a64fdabf10be9e54de728876667da20255Affected
6ea0a69ca21bbddab5b3979c2190013b0263e749 to before e0ff39448cea654843744c72c6780293c5082cb1Affected
6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 78a07732fbb0934d14827d8f09b9aa6a49ee1aa9Affected
6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2dAffected
6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 4abc8c07a065ecf771827bde3c63fbbe4aa0c08bAffected
6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 5d20c6f932f2758078d0454729129c894fe353e7Affected
6ea0a69ca21bbddab5b3979c2190013b0263e749 to before c0445feb80a4d0854898118fa01073701f8d356bAffected
6ea0a69ca21bbddab5b3979c2190013b0263e749 to before 60deb9f10eec5c6a20252ed36238b55d8b614a2cAffected

LinuxLinux

3.19Affected
before 3.19Not affected
4.9.330 through 4.9.*Not affected
4.14.295 through 4.14.*Not affected
4.19.260 through 4.19.*Not affected
5.4.215 through 5.4.*Not affected
5.10.142 through 5.10.*Not affected
5.15.66 through 5.15.*Not affected
5.19.8 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.