Use After Free in Linux
CVE-2022-49479
In the Linux kernel, the following vulnerability has been resolved: mt76: fix tx status related use-after-free race on station removal There is a small race window where ongoing tx activity can lead to a skb getting added to the status tracking idr after that idr has already been cleaned up, which will keep the wcid linked in the status poll list. Fix this by only adding status skbs if the wcid pointer is still assigned in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove
Vulnerability class: Use-After-Free
EPSS: 0.003 (17.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions bd1e3e7b693c17a04e7d2bd9119daa482b7c7720, 5.16, 0
- Linux Linux_kernel
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2022-49479?
- CVE-2022-49479 is a high-severity vulnerability in Linux, classified under Use After Free. CVSS score: 8.8/10. Published 2025-02-26.
- How severe is CVE-2022-49479?
- High severity. CVSS v3 base score is 8.8 out of 10.