GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48875 (GCVE-0-2022-48875)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2026-05-11 18:48
VLAI
Title
wifi: mac80211: sdata can be NULL during AMPDU start
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: sdata can be NULL during AMPDU start ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing. Here a trace triggering the race with the hostapd test multi_ap_fronthaul_on_ap: (gdb) list *drv_ampdu_action+0x46 0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396). 391 int ret = -EOPNOTSUPP; 392 393 might_sleep(); 394 395 sdata = get_bss_sdata(sdata); 396 if (!check_sdata_in_driver(sdata)) 397 return -EIO; 398 399 trace_drv_ampdu_action(local, sdata, params); 400 wlan0: moving STA 02:00:00:00:03:00 to state 3 wlan0: associated wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port) wlan0: moving STA 02:00:00:00:03:00 to state 2 wlan0: moving STA 02:00:00:00:03:00 to state 1 wlan0: Removed STA 02:00:00:00:03:00 wlan0: Destroyed STA 02:00:00:00:03:00 BUG: unable to handle page fault for address: fffffffffffffb48 PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Workqueue: phy3 ieee80211_ba_session_work [mac80211] RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 Call Trace: <TASK> ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211] ieee80211_ba_session_work+0xff/0x2e0 [mac80211] process_one_work+0x29f/0x620 worker_thread+0x4d/0x3d0 ? process_one_work+0x620/0x620 kthread+0xfb/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK>
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0ab337032a0dfcd5f2527d3306d3deeba5f95b59 , < 187523fa7c2d4c780f775cb869216865c4a909ef (git)
Affected: 0ab337032a0dfcd5f2527d3306d3deeba5f95b59 , < a12fd43bd175fa52c82f9740179d38c34ca1b62e (git)
Affected: 0ab337032a0dfcd5f2527d3306d3deeba5f95b59 , < c838df8461a601b20dc1b9fb1834d2aad8e2f949 (git)
Affected: 0ab337032a0dfcd5f2527d3306d3deeba5f95b59 , < 69403bad97aa0162e3d7911b27e25abe774093df (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 5.10.165 , ≤ 5.10.* (semver)
Unaffected: 5.15.90 , ≤ 5.15.* (semver)
Unaffected: 6.1.8 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:05:16.319547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:53.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/agg-tx.c",
            "net/mac80211/driver-ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "187523fa7c2d4c780f775cb869216865c4a909ef",
              "status": "affected",
              "version": "0ab337032a0dfcd5f2527d3306d3deeba5f95b59",
              "versionType": "git"
            },
            {
              "lessThan": "a12fd43bd175fa52c82f9740179d38c34ca1b62e",
              "status": "affected",
              "version": "0ab337032a0dfcd5f2527d3306d3deeba5f95b59",
              "versionType": "git"
            },
            {
              "lessThan": "c838df8461a601b20dc1b9fb1834d2aad8e2f949",
              "status": "affected",
              "version": "0ab337032a0dfcd5f2527d3306d3deeba5f95b59",
              "versionType": "git"
            },
            {
              "lessThan": "69403bad97aa0162e3d7911b27e25abe774093df",
              "status": "affected",
              "version": "0ab337032a0dfcd5f2527d3306d3deeba5f95b59",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/agg-tx.c",
            "net/mac80211/driver-ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.165",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.90",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.8",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: sdata can be NULL during AMPDU start\n\nieee80211_tx_ba_session_handle_start() may get NULL for sdata when a\ndeauthentication is ongoing.\n\nHere a trace triggering the race with the hostapd test\nmulti_ap_fronthaul_on_ap:\n\n(gdb) list *drv_ampdu_action+0x46\n0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).\n391             int ret = -EOPNOTSUPP;\n392\n393             might_sleep();\n394\n395             sdata = get_bss_sdata(sdata);\n396             if (!check_sdata_in_driver(sdata))\n397                     return -EIO;\n398\n399             trace_drv_ampdu_action(local, sdata, params);\n400\n\nwlan0: moving STA 02:00:00:00:03:00 to state 3\nwlan0: associated\nwlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)\nwlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0\nwlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)\nwlan0: moving STA 02:00:00:00:03:00 to state 2\nwlan0: moving STA 02:00:00:00:03:00 to state 1\nwlan0: Removed STA 02:00:00:00:03:00\nwlan0: Destroyed STA 02:00:00:00:03:00\nBUG: unable to handle page fault for address: fffffffffffffb48\nPGD 11814067 P4D 11814067 PUD 11816067 PMD 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G        W          6.1.0-rc8-wt+ #59\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\nWorkqueue: phy3 ieee80211_ba_session_work [mac80211]\nRIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211]\nCode: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 \u003c8b\u003e 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85\nRSP: 0018:ffffc900025ebd20 EFLAGS: 00010287\nRAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240\nRDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40\nRBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0\nR13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8\nFS:  0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0\nCall Trace:\n \u003cTASK\u003e\n ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]\n ieee80211_ba_session_work+0xff/0x2e0 [mac80211]\n process_one_work+0x29f/0x620\n worker_thread+0x4d/0x3d0\n ? process_one_work+0x620/0x620\n kthread+0xfb/0x120\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:48:51.142Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/187523fa7c2d4c780f775cb869216865c4a909ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/a12fd43bd175fa52c82f9740179d38c34ca1b62e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c838df8461a601b20dc1b9fb1834d2aad8e2f949"
        },
        {
          "url": "https://git.kernel.org/stable/c/69403bad97aa0162e3d7911b27e25abe774093df"
        }
      ],
      "title": "wifi: mac80211: sdata can be NULL during AMPDU start",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48875",
    "datePublished": "2024-08-21T06:10:06.207Z",
    "dateReserved": "2024-07-16T11:38:08.922Z",
    "dateUpdated": "2026-05-11T18:48:51.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48875",
      "date": "2026-09-16",
      "epss": "0.00245",
      "percentile": "0.15849"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.10.165\", \"matchCriteriaId\": \"7289B566-F15A-4087-ACC5-2366902846E7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.90\", \"matchCriteriaId\": \"E995CDA5-7223-4FDB-BAD3-81B22C763A43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.8\", \"matchCriteriaId\": \"A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: sdata can be NULL during AMPDU start\\n\\nieee80211_tx_ba_session_handle_start() may get NULL for sdata when a\\ndeauthentication is ongoing.\\n\\nHere a trace triggering the race with the hostapd test\\nmulti_ap_fronthaul_on_ap:\\n\\n(gdb) list *drv_ampdu_action+0x46\\n0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).\\n391             int ret = -EOPNOTSUPP;\\n392\\n393             might_sleep();\\n394\\n395             sdata = get_bss_sdata(sdata);\\n396             if (!check_sdata_in_driver(sdata))\\n397                     return -EIO;\\n398\\n399             trace_drv_ampdu_action(local, sdata, params);\\n400\\n\\nwlan0: moving STA 02:00:00:00:03:00 to state 3\\nwlan0: associated\\nwlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)\\nwlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0\\nwlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)\\nwlan0: moving STA 02:00:00:00:03:00 to state 2\\nwlan0: moving STA 02:00:00:00:03:00 to state 1\\nwlan0: Removed STA 02:00:00:00:03:00\\nwlan0: Destroyed STA 02:00:00:00:03:00\\nBUG: unable to handle page fault for address: fffffffffffffb48\\nPGD 11814067 P4D 11814067 PUD 11816067 PMD 0\\nOops: 0000 [#1] PREEMPT SMP PTI\\nCPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G        W          6.1.0-rc8-wt+ #59\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\\nWorkqueue: phy3 ieee80211_ba_session_work [mac80211]\\nRIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211]\\nCode: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 \u003c8b\u003e 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85\\nRSP: 0018:ffffc900025ebd20 EFLAGS: 00010287\\nRAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240\\nRDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40\\nRBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001\\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0\\nR13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8\\nFS:  0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0\\nCall Trace:\\n \u003cTASK\u003e\\n ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]\\n ieee80211_ba_session_work+0xff/0x2e0 [mac80211]\\n process_one_work+0x29f/0x620\\n worker_thread+0x4d/0x3d0\\n ? process_one_work+0x620/0x620\\n kthread+0xfb/0x120\\n ? kthread_complete_and_exit+0x20/0x20\\n ret_from_fork+0x22/0x30\\n \u003c/TASK\u003e\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: wifi: mac80211: sdata puede ser NULL durante el inicio de AMPDU. ieee80211_tx_ba_session_handle_start() puede obtener NULL para sdata cuando se est\\u00e1 realizando una desautenticaci\\u00f3n. Aqu\\u00ed un rastro que desencadena la ejecuci\\u00f3n con la prueba hostapd multi_ap_fronthaul_on_ap: (gdb) list *drv_ampdu_action+0x46 0x8b16 est\\u00e1 en drv_ampdu_action (net/mac80211/driver-ops.c:396). 391 int ret = -EOPNOTSUPP; 392 393 podr\\u00eda_dormir(); 394 395 sdata = get_bss_sdata(sdata); 396 si (!check_sdata_in_driver(sdata)) 397 retorno -EIO; 398 399 trace_drv_ampdu_action(local, sdata, params); 400 wlan0: mover STA 02:00:00:00:03:00 al estado 3 wlan0: wlan0 asociado: desautenticar desde 02:00:00:00:03:00 por elecci\\u00f3n local (Raz\\u00f3n: 3=DEAUTH_LEAVING) wlan3.sta1 : Sesi\\u00f3n de BA abierta solicitada para 02:00:00:00:00:00 tid 0 wlan3.sta1: cuadro eliminado a 02:00:00:00:00:00 (puerto no autorizado) wlan0: moviendo STA 02:00:00 :00:03:00 al estado 2 wlan0: moviendo STA 02:00:00:00:03:00 al estado 1 wlan0: STA eliminada 02:00:00:00:03:00 wlan0: STA destruida 02:00: 00:00:03:00 ERROR: no se puede manejar el error de p\\u00e1gina para la direcci\\u00f3n: fffffffffffffffb48 PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 Ups: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted : GW 6.1.0-rc8-wt+ #59 Nombre del hardware: PC est\\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 01/04/2014 Cola de trabajo: phy3 ieee80211_ba_session_work [mac80211] RIP: _ampdu_acci\\u00f3n +0x46/0x280 [mac80211] C\\u00f3digo: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 10 0e 00 00 \u0026lt;8b\u0026gt; 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 RAX: 0000000000000000 RBX: ffffffffffff1f0 RCX: ffff888102228240 RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 R10: 00000000000000001 R11: 0000000000000000 R12: 888118c18ec0 R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 FS: 0000000000000000(0000) GS:ffff88817a600000(0000) 0000000000000 CS: 0010 DS: 0000 ES : 0000 CR0: 0000000080050033 CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 Seguimiento de llamadas:  ieee80211_tx_ba_session_handle_start+0xd0/0x190 11] ieee80211_ba_session_work+0xff/0x2e0 [mac80211] Process_one_work+0x29f/0x620 trabajador_thread+0x4d/0x3d0? proceso_one_work+0x620/0x620 kthread+0xfb/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 \"}]",
      "id": "CVE-2022-48875",
      "lastModified": "2024-09-04T18:33:03.537",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-21T07:15:04.440",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/187523fa7c2d4c780f775cb869216865c4a909ef\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/69403bad97aa0162e3d7911b27e25abe774093df\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a12fd43bd175fa52c82f9740179d38c34ca1b62e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c838df8461a601b20dc1b9fb1834d2aad8e2f949\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48875\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:04.440\",\"lastModified\":\"2026-06-17T05:16:28.783\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: sdata can be NULL during AMPDU start\\n\\nieee80211_tx_ba_session_handle_start() may get NULL for sdata when a\\ndeauthentication is ongoing.\\n\\nHere a trace triggering the race with the hostapd test\\nmulti_ap_fronthaul_on_ap:\\n\\n(gdb) list *drv_ampdu_action+0x46\\n0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).\\n391             int ret = -EOPNOTSUPP;\\n392\\n393             might_sleep();\\n394\\n395             sdata = get_bss_sdata(sdata);\\n396             if (!check_sdata_in_driver(sdata))\\n397                     return -EIO;\\n398\\n399             trace_drv_ampdu_action(local, sdata, params);\\n400\\n\\nwlan0: moving STA 02:00:00:00:03:00 to state 3\\nwlan0: associated\\nwlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)\\nwlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0\\nwlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)\\nwlan0: moving STA 02:00:00:00:03:00 to state 2\\nwlan0: moving STA 02:00:00:00:03:00 to state 1\\nwlan0: Removed STA 02:00:00:00:03:00\\nwlan0: Destroyed STA 02:00:00:00:03:00\\nBUG: unable to handle page fault for address: fffffffffffffb48\\nPGD 11814067 P4D 11814067 PUD 11816067 PMD 0\\nOops: 0000 [#1] PREEMPT SMP PTI\\nCPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G        W          6.1.0-rc8-wt+ #59\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\\nWorkqueue: phy3 ieee80211_ba_session_work [mac80211]\\nRIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211]\\nCode: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 \u003c8b\u003e 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85\\nRSP: 0018:ffffc900025ebd20 EFLAGS: 00010287\\nRAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240\\nRDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40\\nRBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001\\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0\\nR13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8\\nFS:  0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0\\nCall Trace:\\n \u003cTASK\u003e\\n ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]\\n ieee80211_ba_session_work+0xff/0x2e0 [mac80211]\\n process_one_work+0x29f/0x620\\n worker_thread+0x4d/0x3d0\\n ? process_one_work+0x620/0x620\\n kthread+0xfb/0x120\\n ? kthread_complete_and_exit+0x20/0x20\\n ret_from_fork+0x22/0x30\\n \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: wifi: mac80211: sdata puede ser NULL durante el inicio de AMPDU. ieee80211_tx_ba_session_handle_start() puede obtener NULL para sdata cuando se est\u00e1 realizando una desautenticaci\u00f3n. Aqu\u00ed un rastro que desencadena la ejecuci\u00f3n con la prueba hostapd multi_ap_fronthaul_on_ap: (gdb) list *drv_ampdu_action+0x46 0x8b16 est\u00e1 en drv_ampdu_action (net/mac80211/driver-ops.c:396). 391 int ret = -EOPNOTSUPP; 392 393 podr\u00eda_dormir(); 394 395 sdata = get_bss_sdata(sdata); 396 si (!check_sdata_in_driver(sdata)) 397 retorno -EIO; 398 399 trace_drv_ampdu_action(local, sdata, params); 400 wlan0: mover STA 02:00:00:00:03:00 al estado 3 wlan0: wlan0 asociado: desautenticar desde 02:00:00:00:03:00 por elecci\u00f3n local (Raz\u00f3n: 3=DEAUTH_LEAVING) wlan3.sta1 : Sesi\u00f3n de BA abierta solicitada para 02:00:00:00:00:00 tid 0 wlan3.sta1: cuadro eliminado a 02:00:00:00:00:00 (puerto no autorizado) wlan0: moviendo STA 02:00:00 :00:03:00 al estado 2 wlan0: moviendo STA 02:00:00:00:03:00 al estado 1 wlan0: STA eliminada 02:00:00:00:03:00 wlan0: STA destruida 02:00: 00:00:03:00 ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: fffffffffffffffb48 PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 Ups: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted : GW 6.1.0-rc8-wt+ #59 Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 01/04/2014 Cola de trabajo: phy3 ieee80211_ba_session_work [mac80211] RIP: _ampdu_acci\u00f3n +0x46/0x280 [mac80211] C\u00f3digo: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 10 0e 00 00 \u0026lt;8b\u0026gt; 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 RAX: 0000000000000000 RBX: ffffffffffff1f0 RCX: ffff888102228240 RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 R10: 00000000000000001 R11: 0000000000000000 R12: 888118c18ec0 R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 FS: 0000000000000000(0000) GS:ffff88817a600000(0000) 0000000000000 CS: 0010 DS: 0000 ES : 0000 CR0: 0000000080050033 CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 Seguimiento de llamadas:  ieee80211_tx_ba_session_handle_start+0xd0/0x190 11] ieee80211_ba_session_work+0xff/0x2e0 [mac80211] Process_one_work+0x29f/0x620 trabajador_thread+0x4d/0x3d0? proceso_one_work+0x620/0x620 kthread+0xfb/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/agg-tx.c\",\"net/mac80211/driver-ops.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0ab337032a0dfcd5f2527d3306d3deeba5f95b59\",\"lessThan\":\"187523fa7c2d4c780f775cb869216865c4a909ef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0ab337032a0dfcd5f2527d3306d3deeba5f95b59\",\"lessThan\":\"a12fd43bd175fa52c82f9740179d38c34ca1b62e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0ab337032a0dfcd5f2527d3306d3deeba5f95b59\",\"lessThan\":\"c838df8461a601b20dc1b9fb1834d2aad8e2f949\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0ab337032a0dfcd5f2527d3306d3deeba5f95b59\",\"lessThan\":\"69403bad97aa0162e3d7911b27e25abe774093df\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/agg-tx.c\",\"net/mac80211/driver-ops.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.36\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.36\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.165\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.90\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.8\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:05:16.319547Z\",\"id\":\"CVE-2022-48875\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.165\",\"matchCriteriaId\":\"7289B566-F15A-4087-ACC5-2366902846E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.90\",\"matchCriteriaId\":\"E995CDA5-7223-4FDB-BAD3-81B22C763A43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.8\",\"matchCriteriaId\":\"A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/187523fa7c2d4c780f775cb869216865c4a909ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69403bad97aa0162e3d7911b27e25abe774093df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a12fd43bd175fa52c82f9740179d38c34ca1b62e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c838df8461a601b20dc1b9fb1834d2aad8e2f949\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-02-02T10:58:03+00:00",
      "cve": "CVE-2022-48875",
      "id": "CVE-2022-48875",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: sdata can be NULL during AMPDU start",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48875.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:33:11Z",
      "cve": "CVE-2022-48875",
      "id": "CVE-2022-48875",
      "initial_release_date": "2024-08-22T03:29:34Z",
      "product_status:known_affected": "493",
      "product_status:known_not_affected": "63",
      "product_status:recommended": "518",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48875",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48875.json",
      "version": "67"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48875\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:05:16.319547Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:11.897Z\"}}], \"cna\": {\"title\": \"wifi: mac80211: sdata can be NULL during AMPDU start\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0ab337032a0dfcd5f2527d3306d3deeba5f95b59\", \"lessThan\": \"187523fa7c2d4c780f775cb869216865c4a909ef\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0ab337032a0dfcd5f2527d3306d3deeba5f95b59\", \"lessThan\": \"a12fd43bd175fa52c82f9740179d38c34ca1b62e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0ab337032a0dfcd5f2527d3306d3deeba5f95b59\", \"lessThan\": \"c838df8461a601b20dc1b9fb1834d2aad8e2f949\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0ab337032a0dfcd5f2527d3306d3deeba5f95b59\", \"lessThan\": \"69403bad97aa0162e3d7911b27e25abe774093df\", \"versionType\": \"git\"}], \"programFiles\": [\"net/mac80211/agg-tx.c\", \"net/mac80211/driver-ops.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.36\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.36\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.90\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/mac80211/agg-tx.c\", \"net/mac80211/driver-ops.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/187523fa7c2d4c780f775cb869216865c4a909ef\"}, {\"url\": \"https://git.kernel.org/stable/c/a12fd43bd175fa52c82f9740179d38c34ca1b62e\"}, {\"url\": \"https://git.kernel.org/stable/c/c838df8461a601b20dc1b9fb1834d2aad8e2f949\"}, {\"url\": \"https://git.kernel.org/stable/c/69403bad97aa0162e3d7911b27e25abe774093df\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: sdata can be NULL during AMPDU start\\n\\nieee80211_tx_ba_session_handle_start() may get NULL for sdata when a\\ndeauthentication is ongoing.\\n\\nHere a trace triggering the race with the hostapd test\\nmulti_ap_fronthaul_on_ap:\\n\\n(gdb) list *drv_ampdu_action+0x46\\n0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).\\n391             int ret = -EOPNOTSUPP;\\n392\\n393             might_sleep();\\n394\\n395             sdata = get_bss_sdata(sdata);\\n396             if (!check_sdata_in_driver(sdata))\\n397                     return -EIO;\\n398\\n399             trace_drv_ampdu_action(local, sdata, params);\\n400\\n\\nwlan0: moving STA 02:00:00:00:03:00 to state 3\\nwlan0: associated\\nwlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)\\nwlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0\\nwlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)\\nwlan0: moving STA 02:00:00:00:03:00 to state 2\\nwlan0: moving STA 02:00:00:00:03:00 to state 1\\nwlan0: Removed STA 02:00:00:00:03:00\\nwlan0: Destroyed STA 02:00:00:00:03:00\\nBUG: unable to handle page fault for address: fffffffffffffb48\\nPGD 11814067 P4D 11814067 PUD 11816067 PMD 0\\nOops: 0000 [#1] PREEMPT SMP PTI\\nCPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G        W          6.1.0-rc8-wt+ #59\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\\nWorkqueue: phy3 ieee80211_ba_session_work [mac80211]\\nRIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211]\\nCode: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 \u003c8b\u003e 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85\\nRSP: 0018:ffffc900025ebd20 EFLAGS: 00010287\\nRAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240\\nRDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40\\nRBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001\\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0\\nR13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8\\nFS:  0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0\\nCall Trace:\\n \u003cTASK\u003e\\n ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]\\n ieee80211_ba_session_work+0xff/0x2e0 [mac80211]\\n process_one_work+0x29f/0x620\\n worker_thread+0x4d/0x3d0\\n ? process_one_work+0x620/0x620\\n kthread+0xfb/0x120\\n ? kthread_complete_and_exit+0x20/0x20\\n ret_from_fork+0x22/0x30\\n \u003c/TASK\u003e\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.165\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.90\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.8\", \"versionStartIncluding\": \"2.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"2.6.36\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-12-23T13:20:59.868Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48875\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-12-23T13:20:59.868Z\", \"dateReserved\": \"2024-07-16T11:38:08.922Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T06:10:06.207Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.