CVE-2022-49479: mt76: fix tx status related use-after-free race on station removal

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-08-04
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: mt76: fix tx status related use-after-free race on station removal There is a small race window where ongoing tx activity can lead to a skb getting added to the status tracking idr after that idr has already been cleaned up, which will keep the wcid linked in the status poll list. Fix this by only adding status skbs if the wcid pointer is still assigned in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove

Affected products

Linux kernel: from 5.16 before 5.17.14; from 5.18 before 5.18.3 — fixed in 5.17.14, 5.18.3

How to fix

Upgrade to a fixed version: Linux kernel 5.17.14, 5.18.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49479 or the next vulnerability affects your stack