GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49326 (GCVE-0-2022-49326)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:10 – Updated: 2026-05-11 18:57
VLAI
Title
rtl818x: Prevent using not initialized queues
Summary
In the Linux kernel, the following vulnerability has been resolved: rtl818x: Prevent using not initialized queues Using not existing queues can panic the kernel with rtl8180/rtl8185 cards. Ignore the skb priority for those cards, they only have one tx queue. Pierre Asselin (pa@panix.com) reported the kernel crash in the Gentoo forum: https://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html He also confirmed that this patch fixes the issue. In summary this happened: After updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a "divide error: 0000" when connecting to an AP. Control port tx now tries to use IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in 2.10. Since only the rtl8187se part of the driver supports QoS, the priority of the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185 cards. rtl8180 is then unconditionally reading out the priority and finally crashes on drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this patch: idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries "ring->entries" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got initialized.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:43 UTC
CWE
  • CWE-908 - Use of Uninitialized Resource
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < b5dca2cd3f0239512da808598b4e70557eb4c2a1 (git)
Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < d7e30dfc166d33470bba31a42f9bbc346e5409d5 (git)
Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < 9d5e96cc1f1720019ce27b127a31695148d38bb0 (git)
Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < b8ce58ab80faaea015c206382041ff3bcf5495ff (git)
Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < 769ec2a824deae2f1268dfda14999a4d14d0d0c5 (git)
Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < 6ad81ad0cf5744738ce94c8e64051ddd80a1734c (git)
Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < 9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577 (git)
Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < 98e55b0b876bde3353f4e074883d66ecb55c65a3 (git)
Affected: fd6564fcdc0bfcd432e6e939f9538acc3905d08a , < 746285cf81dc19502ab238249d75f5990bd2d231 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.15
Unaffected: 0 , < 3.15 (semver)
Unaffected: 4.9.318 , ≤ 4.9.* (semver)
Unaffected: 4.14.283 , ≤ 4.14.* (semver)
Unaffected: 4.19.247 , ≤ 4.19.* (semver)
Unaffected: 5.4.198 , ≤ 5.4.* (semver)
Unaffected: 5.10.121 , ≤ 5.10.* (semver)
Unaffected: 5.15.46 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49326",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:43:30.625103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-908",
                "description": "CWE-908 Use of Uninitialized Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:56.034Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5dca2cd3f0239512da808598b4e70557eb4c2a1",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            },
            {
              "lessThan": "d7e30dfc166d33470bba31a42f9bbc346e5409d5",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            },
            {
              "lessThan": "9d5e96cc1f1720019ce27b127a31695148d38bb0",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            },
            {
              "lessThan": "b8ce58ab80faaea015c206382041ff3bcf5495ff",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            },
            {
              "lessThan": "769ec2a824deae2f1268dfda14999a4d14d0d0c5",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            },
            {
              "lessThan": "6ad81ad0cf5744738ce94c8e64051ddd80a1734c",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            },
            {
              "lessThan": "9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            },
            {
              "lessThan": "98e55b0b876bde3353f4e074883d66ecb55c65a3",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            },
            {
              "lessThan": "746285cf81dc19502ab238249d75f5990bd2d231",
              "status": "affected",
              "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.318",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.318",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.283",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtl818x: Prevent using not initialized queues\n\nUsing not existing queues can panic the kernel with rtl8180/rtl8185 cards.\nIgnore the skb priority for those cards, they only have one tx queue. Pierre\nAsselin (pa@panix.com) reported the kernel crash in the Gentoo forum:\n\nhttps://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html\n\nHe also confirmed that this patch fixes the issue. In summary this happened:\n\nAfter updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a\n\"divide error: 0000\" when connecting to an AP. Control port tx now tries to\nuse IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in\n2.10.\n\nSince only the rtl8187se part of the driver supports QoS, the priority\nof the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185\ncards.\n\nrtl8180 is then unconditionally reading out the priority and finally crashes on\ndrivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this\npatch:\n\tidx = (ring-\u003eidx + skb_queue_len(\u0026ring-\u003equeue)) % ring-\u003eentries\n\n\"ring-\u003eentries\" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got\ninitialized."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:57:31.977Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5dca2cd3f0239512da808598b4e70557eb4c2a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7e30dfc166d33470bba31a42f9bbc346e5409d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d5e96cc1f1720019ce27b127a31695148d38bb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8ce58ab80faaea015c206382041ff3bcf5495ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/769ec2a824deae2f1268dfda14999a4d14d0d0c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ad81ad0cf5744738ce94c8e64051ddd80a1734c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577"
        },
        {
          "url": "https://git.kernel.org/stable/c/98e55b0b876bde3353f4e074883d66ecb55c65a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/746285cf81dc19502ab238249d75f5990bd2d231"
        }
      ],
      "title": "rtl818x: Prevent using not initialized queues",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49326",
    "datePublished": "2025-02-26T02:10:48.630Z",
    "dateReserved": "2025-02-26T02:08:31.538Z",
    "dateUpdated": "2026-05-11T18:57:31.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49326",
      "date": "2026-09-19",
      "epss": "0.0029",
      "percentile": "0.218"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b5dca2cd3f0239512da808598b4e70557eb4c2a1",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d7e30dfc166d33470bba31a42f9bbc346e5409d5",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9d5e96cc1f1720019ce27b127a31695148d38bb0",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b8ce58ab80faaea015c206382041ff3bcf5495ff",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "769ec2a824deae2f1268dfda14999a4d14d0d0c5",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6ad81ad0cf5744738ce94c8e64051ddd80a1734c",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98e55b0b876bde3353f4e074883d66ecb55c65a3",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "746285cf81dc19502ab238249d75f5990bd2d231",
                    "status": "affected",
                    "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.15"
                  },
                  {
                    "lessThan": "3.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.318",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.283",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.247",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.198",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.121",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0D4D4067-974D-4560-8320-22FDA399E3F9",
                    "versionEndExcluding": "4.9.318",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D6823775-2653-4644-A0D4-4E6E68F10C65",
                    "versionEndExcluding": "4.14.283",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B8CFA0F4-2D75-41F4-9753-87944A08B53B",
                    "versionEndExcluding": "4.19.247",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3EC49633-14DE-4EBD-BB80-76AE2E3EABB9",
                    "versionEndExcluding": "5.4.198",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "34ACD872-E5BC-401C-93D5-B357A62426E0",
                    "versionEndExcluding": "5.10.121",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20D41697-0E8B-4B7D-8842-F17BF2AA21E1",
                    "versionEndExcluding": "5.15.46",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15E2DD33-2255-4B76-9C15-04FF8CBAB252",
                    "versionEndExcluding": "5.17.14",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2",
                    "versionEndExcluding": "5.18.3",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtl818x: Prevent using not initialized queues\n\nUsing not existing queues can panic the kernel with rtl8180/rtl8185 cards.\nIgnore the skb priority for those cards, they only have one tx queue. Pierre\nAsselin (pa@panix.com) reported the kernel crash in the Gentoo forum:\n\nhttps://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html\n\nHe also confirmed that this patch fixes the issue. In summary this happened:\n\nAfter updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a\n\"divide error: 0000\" when connecting to an AP. Control port tx now tries to\nuse IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in\n2.10.\n\nSince only the rtl8187se part of the driver supports QoS, the priority\nof the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185\ncards.\n\nrtl8180 is then unconditionally reading out the priority and finally crashes on\ndrivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this\npatch:\n\tidx = (ring-\u003eidx + skb_queue_len(\u0026ring-\u003equeue)) % ring-\u003eentries\n\n\"ring-\u003eentries\" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got\ninitialized."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rtl818x: Evitar el uso de colas no inicializadas El uso de colas no existentes puede provocar un p\u00e1nico en el kernel con tarjetas rtl8180/rtl8185. Ignore la prioridad skb para esas tarjetas, solo tienen una cola tx. Pierre Asselin (pa@panix.com) inform\u00f3 sobre el fallo del kernel en el foro de Gentoo: https://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html Tambi\u00e9n confirm\u00f3 que este parche soluciona el problema. En resumen, esto sucedi\u00f3: Despu\u00e9s de actualizar wpa_supplicant de 2.9 a 2.10, el kernel se bloque\u00f3 con un \"error de divisi\u00f3n: 0000\" al conectarse a un AP. El puerto de control tx ahora intenta usar IEEE80211_AC_VO para la prioridad, que wpa_supplicants comienza a usar en 2.10. Como solo la parte rtl8187se del controlador admite QoS, la prioridad del skb se establece en IEEE80211_AC_BE (2) por mac80211 para las tarjetas rtl8180/rtl8185. Luego, rtl8180 lee incondicionalmente la prioridad y finalmente se bloquea en la l\u00ednea 544 de drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c sin este parche: idx = (ring-\u0026gt;idx + skb_queue_len(\u0026amp;ring-\u0026gt;queue)) % ring-\u0026gt;entries \"ring-\u0026gt;entries\" es cero para las tarjetas rtl8180/rtl8185, tx_ring[2] nunca se inicializ\u00f3."
          }
        ],
        "id": "CVE-2022-49326",
        "lastModified": "2026-06-17T05:17:43.483",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49326",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:43:30.625103Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-26T07:01:09.417",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6ad81ad0cf5744738ce94c8e64051ddd80a1734c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/746285cf81dc19502ab238249d75f5990bd2d231"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/769ec2a824deae2f1268dfda14999a4d14d0d0c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/98e55b0b876bde3353f4e074883d66ecb55c65a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9d5e96cc1f1720019ce27b127a31695148d38bb0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b5dca2cd3f0239512da808598b4e70557eb4c2a1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b8ce58ab80faaea015c206382041ff3bcf5495ff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d7e30dfc166d33470bba31a42f9bbc346e5409d5"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-908"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-908"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:03:51+00:00",
      "cve": "CVE-2022-49326",
      "id": "CVE-2022-49326",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rtl818x: Prevent using not initialized queues",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49326.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:28:51Z",
      "cve": "CVE-2022-49326",
      "id": "CVE-2022-49326",
      "initial_release_date": "2025-02-27T03:08:42Z",
      "product_status:known_affected": "489",
      "product_status:known_not_affected": "154",
      "product_status:recommended": "330",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49326",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49326.json",
      "version": "83"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49326",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:43:30.625103Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-908",
                    "description": "CWE-908 Use of Uninitialized Resource",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T16:15:24.336Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "b5dca2cd3f0239512da808598b4e70557eb4c2a1",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                },
                {
                  "lessThan": "d7e30dfc166d33470bba31a42f9bbc346e5409d5",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                },
                {
                  "lessThan": "9d5e96cc1f1720019ce27b127a31695148d38bb0",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                },
                {
                  "lessThan": "b8ce58ab80faaea015c206382041ff3bcf5495ff",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                },
                {
                  "lessThan": "769ec2a824deae2f1268dfda14999a4d14d0d0c5",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                },
                {
                  "lessThan": "6ad81ad0cf5744738ce94c8e64051ddd80a1734c",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                },
                {
                  "lessThan": "9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                },
                {
                  "lessThan": "98e55b0b876bde3353f4e074883d66ecb55c65a3",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                },
                {
                  "lessThan": "746285cf81dc19502ab238249d75f5990bd2d231",
                  "status": "affected",
                  "version": "fd6564fcdc0bfcd432e6e939f9538acc3905d08a",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.15"
                },
                {
                  "lessThan": "3.15",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.318",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.283",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.247",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.198",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.121",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.46",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.17.*",
                  "status": "unaffected",
                  "version": "5.17.14",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.18.*",
                  "status": "unaffected",
                  "version": "5.18.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.19",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.318",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.283",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.247",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.198",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.121",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.46",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17.14",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18.3",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19",
                      "versionStartIncluding": "3.15",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtl818x: Prevent using not initialized queues\n\nUsing not existing queues can panic the kernel with rtl8180/rtl8185 cards.\nIgnore the skb priority for those cards, they only have one tx queue. Pierre\nAsselin (pa@panix.com) reported the kernel crash in the Gentoo forum:\n\nhttps://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html\n\nHe also confirmed that this patch fixes the issue. In summary this happened:\n\nAfter updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a\n\"divide error: 0000\" when connecting to an AP. Control port tx now tries to\nuse IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in\n2.10.\n\nSince only the rtl8187se part of the driver supports QoS, the priority\nof the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185\ncards.\n\nrtl8180 is then unconditionally reading out the priority and finally crashes on\ndrivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this\npatch:\n\tidx = (ring-\u003eidx + skb_queue_len(\u0026ring-\u003equeue)) % ring-\u003eentries\n\n\"ring-\u003eentries\" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got\ninitialized."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T18:57:31.977Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/b5dca2cd3f0239512da808598b4e70557eb4c2a1"
            },
            {
              "url": "https://git.kernel.org/stable/c/d7e30dfc166d33470bba31a42f9bbc346e5409d5"
            },
            {
              "url": "https://git.kernel.org/stable/c/9d5e96cc1f1720019ce27b127a31695148d38bb0"
            },
            {
              "url": "https://git.kernel.org/stable/c/b8ce58ab80faaea015c206382041ff3bcf5495ff"
            },
            {
              "url": "https://git.kernel.org/stable/c/769ec2a824deae2f1268dfda14999a4d14d0d0c5"
            },
            {
              "url": "https://git.kernel.org/stable/c/6ad81ad0cf5744738ce94c8e64051ddd80a1734c"
            },
            {
              "url": "https://git.kernel.org/stable/c/9ad1981fc4de3afb7db3e8eb5a6a52d4c7d0d577"
            },
            {
              "url": "https://git.kernel.org/stable/c/98e55b0b876bde3353f4e074883d66ecb55c65a3"
            },
            {
              "url": "https://git.kernel.org/stable/c/746285cf81dc19502ab238249d75f5990bd2d231"
            }
          ],
          "title": "rtl818x: Prevent using not initialized queues",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49326",
        "datePublished": "2025-02-26T02:10:48.630Z",
        "dateReserved": "2025-02-26T02:08:31.538Z",
        "dateUpdated": "2026-05-11T18:57:31.977Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.