CVE-2022-42721

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-10-14 · updated 2026-10-14
Weakness: CWE-835

Description

A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.

Affected products

Debian Linux: 10.0, 11.0
Fedoraproject Fedora: 35, 36, 37
Linux kernel: from 5.1 before 5.19.16 — fixed in 5.19.16

How to fix

Upgrade to a fixed version: Linux kernel 5.19.16. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html
http://www.openwall.com/lists/oss-security/2022/10/13/5
https://bugzilla.suse.com/show_bug.cgi?id=1204060
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=bcca852027e5878aec911a347407ecc88d6fff7f
https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2KTU5LFZNQS7YNGE56MT46VHMXL3DD2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNN3VFQPECS6D4PS6ZWD7AFXTOSJDSSR/
https://security.netapp.com/advisory/ntap-20230203-0008/
https://www.debian.org/security/2022/dsa-5257
http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html
http://www.openwall.com/lists/oss-security/2022/10/13/5

Get alerted when CVE-2022-42721 or the next vulnerability affects your stack