CVE-2022-49942

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected

When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense.

The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard.

Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa().

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= cd7760e62c2ac8581f050b2d36501d1a60beaf83, < cdb9a8da9b84800eb15506cd9363cf0cf059e677; >= cd7760e62c2ac8581f050b2d36501d1a60beaf83, < 1691a48aef0a82d1754b9853dae7e3f5cacdf70b; >= cd7760e62c2ac8581f050b2d36501d1a60beaf83, < d9eb37db6a28b59a95a3461450ee209654c5f95b; >= cd7760e62c2ac8581f050b2d36501d1a60beaf83, < 66689c5c02acd4d76c28498fe220998610aec61e; >= cd7760e62c2ac8581f050b2d36501d1a60beaf83, < dd649b49219a0388cc10fc40e4c2ea681566a780; >= cd7760e62c2ac8581f050b2d36501d1a60beaf83, < 552ba102a6898630a7d16887f29e606d6fabe508; >= cd7760e62c2ac8581f050b2d36501d1a60beaf83, < 864e280cb3a9a0f5212b16ef5057c4e692f7039d; >= cd7760e62c2ac8581f050b2d36501d1a60beaf83, < 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0
LinuxLinux3.13

References

Timeline

Published
Jun 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-499435.5In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix obscure lockdep violation for udc_mutex A recent commCVE-2022-499445.5In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectCVE-2022-499457.1In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not cCVE-2022-499467.1In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Prevent out-of-bounds access The while loop in raspberrCVE-2022-499475.5In the Linux kernel, the following vulnerability has been resolved: binder: fix alloc->vma_vm_mm null-ptr dereference Syzbot reported a coCVE-2022-499487.1In the Linux kernel, the following vulnerability has been resolved: vt: Clear selection before changing the font When changing the consoleCVE-2022-499495.5In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix memory leak in firmware upload In the case of firCVE-2022-49959.8Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to uCVE-2022-499507.8In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix memory corruption on open The probe session-duplicaCVE-2022-499517.8In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix use-after-free during unregister In the followingCVE-2022-499527.8In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix memory corruption on probe Add the missing sanity cCVE-2022-499535.5In the Linux kernel, the following vulnerability has been resolved: iio: light: cm3605: Fix an error handling path in cm3605_probe() The c
CVE-2022-49942: Medium severity, CVSS 5.5 | Vulnix