CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-08-04
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point. However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx.

Affected products

Linux kernel: from 3.17 before 4.9.318; from 4.10 before 4.14.283; from 4.15 before 4.19.247; from 4.20 before 5.4.198; from 5.5 before 5.10.121; from 5.11 before 5.15.46 — fixed in 4.14.283, 4.19.247, 4.9.318, 5.10.121, 5.15.46, 5.17.14

How to fix

Upgrade to a fixed version: Linux kernel 4.14.283, 4.19.247, 4.9.318, 5.10.121. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49416 or the next vulnerability affects your stack