GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49934 (GCVE-0-2022-49934)

Vulnerability from cvelistv5 – Published: 2025-06-18 10:54 – Updated: 2026-08-05 08:56
VLAI
Title
wifi: mac80211: Fix UAF in ieee80211_scan_rx()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix UAF in ieee80211_scan_rx() ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req. Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done().
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6ea0a69ca21bbddab5b3979c2190013b0263e749 , < 6eb181a64fdabf10be9e54de728876667da20255 (git)
Affected: 6ea0a69ca21bbddab5b3979c2190013b0263e749 , < e0ff39448cea654843744c72c6780293c5082cb1 (git)
Affected: 6ea0a69ca21bbddab5b3979c2190013b0263e749 , < 78a07732fbb0934d14827d8f09b9aa6a49ee1aa9 (git)
Affected: 6ea0a69ca21bbddab5b3979c2190013b0263e749 , < 9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d (git)
Affected: 6ea0a69ca21bbddab5b3979c2190013b0263e749 , < 4abc8c07a065ecf771827bde3c63fbbe4aa0c08b (git)
Affected: 6ea0a69ca21bbddab5b3979c2190013b0263e749 , < 5d20c6f932f2758078d0454729129c894fe353e7 (git)
Affected: 6ea0a69ca21bbddab5b3979c2190013b0263e749 , < c0445feb80a4d0854898118fa01073701f8d356b (git)
Affected: 6ea0a69ca21bbddab5b3979c2190013b0263e749 , < 60deb9f10eec5c6a20252ed36238b55d8b614a2c (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 4.9.330 , ≤ 4.9.* (semver)
Unaffected: 4.14.295 , ≤ 4.14.* (semver)
Unaffected: 4.19.260 , ≤ 4.19.* (semver)
Unaffected: 5.4.215 , ≤ 5.4.* (semver)
Unaffected: 5.10.142 , ≤ 5.10.* (semver)
Unaffected: 5.15.66 , ≤ 5.15.* (semver)
Unaffected: 5.19.8 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6eb181a64fdabf10be9e54de728876667da20255",
              "status": "affected",
              "version": "6ea0a69ca21bbddab5b3979c2190013b0263e749",
              "versionType": "git"
            },
            {
              "lessThan": "e0ff39448cea654843744c72c6780293c5082cb1",
              "status": "affected",
              "version": "6ea0a69ca21bbddab5b3979c2190013b0263e749",
              "versionType": "git"
            },
            {
              "lessThan": "78a07732fbb0934d14827d8f09b9aa6a49ee1aa9",
              "status": "affected",
              "version": "6ea0a69ca21bbddab5b3979c2190013b0263e749",
              "versionType": "git"
            },
            {
              "lessThan": "9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d",
              "status": "affected",
              "version": "6ea0a69ca21bbddab5b3979c2190013b0263e749",
              "versionType": "git"
            },
            {
              "lessThan": "4abc8c07a065ecf771827bde3c63fbbe4aa0c08b",
              "status": "affected",
              "version": "6ea0a69ca21bbddab5b3979c2190013b0263e749",
              "versionType": "git"
            },
            {
              "lessThan": "5d20c6f932f2758078d0454729129c894fe353e7",
              "status": "affected",
              "version": "6ea0a69ca21bbddab5b3979c2190013b0263e749",
              "versionType": "git"
            },
            {
              "lessThan": "c0445feb80a4d0854898118fa01073701f8d356b",
              "status": "affected",
              "version": "6ea0a69ca21bbddab5b3979c2190013b0263e749",
              "versionType": "git"
            },
            {
              "lessThan": "60deb9f10eec5c6a20252ed36238b55d8b614a2c",
              "status": "affected",
              "version": "6ea0a69ca21bbddab5b3979c2190013b0263e749",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.330",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.330",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.295",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.260",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.215",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.142",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.66",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.8",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Fix UAF in ieee80211_scan_rx()\n\nieee80211_scan_rx() tries to access scan_req-\u003eflags after a\nnull check, but a UAF is observed when the scan is completed\nand __ieee80211_scan_completed() executes, which then calls\ncfg80211_scan_done() leading to the freeing of scan_req.\n\nSince scan_req is rcu_dereference()\u0027d, prevent the racing in\n__ieee80211_scan_completed() by ensuring that from mac80211\u0027s\nPOV it is no longer accessed from an RCU read critical section\nbefore we call cfg80211_scan_done()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The UAF is hit in ieee80211_scan_rx() on the softirq RX path when processing over-the-air Probe Response frames during an active scan; an attacker on the same Wi\u2011Fi RF segment injects those frames.\nAC:L - The attacker controls the RX side by flooding Probe Responses and can retry across frequent automatic scans (observable via the victim\u2019s Probe Requests), making this an attacker-influenced race rather than an uncontrollable condition.\nPR:N - Frame delivery and scan RX handling require no account or capability on the victim; background/connect/scheduled scans run from system WLAN stacks without attacker-held host privileges.\nUI:N - Phones and laptops routinely scan in the background with Wi\u2011Fi enabled, so Probe Responses are processed at scan completion without further victim action at attack time.\nS:U - The use-after-free corrupts mac80211/cfg80211 heap state inside the host kernel only and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After kfree(scan_req), ieee80211_scan_rx() still reads scan_req-\u003eflags via a dangling RCU reference; reclaiming that cfg80211_scan_request object enables arbitrary kernel disclosure.\nI:H - The same sprayable scan_req UAF in the concurrent RX path yields write and control-flow primitives characteristic of exploitable kernel use-after-frees.\nA:H - Concurrent use of the freed scan_req causes a KASAN-confirmed kernel oops/panic-class crash in the scan RX path, so availability impact is complete even without full code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:46.037Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6eb181a64fdabf10be9e54de728876667da20255"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0ff39448cea654843744c72c6780293c5082cb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/78a07732fbb0934d14827d8f09b9aa6a49ee1aa9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4abc8c07a065ecf771827bde3c63fbbe4aa0c08b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d20c6f932f2758078d0454729129c894fe353e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0445feb80a4d0854898118fa01073701f8d356b"
        },
        {
          "url": "https://git.kernel.org/stable/c/60deb9f10eec5c6a20252ed36238b55d8b614a2c"
        }
      ],
      "title": "wifi: mac80211: Fix UAF in ieee80211_scan_rx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49934",
    "datePublished": "2025-06-18T10:54:36.161Z",
    "dateReserved": "2025-05-01T14:05:17.254Z",
    "dateUpdated": "2026-08-05T08:56:46.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49934",
      "date": "2026-09-15",
      "epss": "0.00246",
      "percentile": "0.15986"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49934\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:19.400\",\"lastModified\":\"2026-08-04T10:18:00.013\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: Fix UAF in ieee80211_scan_rx()\\n\\nieee80211_scan_rx() tries to access scan_req-\u003eflags after a\\nnull check, but a UAF is observed when the scan is completed\\nand __ieee80211_scan_completed() executes, which then calls\\ncfg80211_scan_done() leading to the freeing of scan_req.\\n\\nSince scan_req is rcu_dereference()\u0027d, prevent the racing in\\n__ieee80211_scan_completed() by ensuring that from mac80211\u0027s\\nPOV it is no longer accessed from an RCU read critical section\\nbefore we call cfg80211_scan_done().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mac80211: Se ha corregido el UAF en ieee80211_scan_rx(). ieee80211_scan_rx() intenta acceder a scan_req-\u0026gt;flags tras una comprobaci\u00f3n nula, pero se observa un UAF al finalizar el escaneo y se ejecuta __ieee80211_scan_completed(), que a su vez llama a cfg80211_scan_done(), lo que libera scan_req. Dado que scan_req est\u00e1 desreferenciado mediante rcu_dereference(), se debe evitar la aceleraci\u00f3n en __ieee80211_scan_completed() asegur\u00e1ndose de que, desde el punto de vista de mac80211, ya no se acceda a \u00e9l desde una secci\u00f3n cr\u00edtica de lectura de RCU antes de llamar a cfg80211_scan_done().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6ea0a69ca21bbddab5b3979c2190013b0263e749\",\"lessThan\":\"6eb181a64fdabf10be9e54de728876667da20255\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ea0a69ca21bbddab5b3979c2190013b0263e749\",\"lessThan\":\"e0ff39448cea654843744c72c6780293c5082cb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ea0a69ca21bbddab5b3979c2190013b0263e749\",\"lessThan\":\"78a07732fbb0934d14827d8f09b9aa6a49ee1aa9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ea0a69ca21bbddab5b3979c2190013b0263e749\",\"lessThan\":\"9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ea0a69ca21bbddab5b3979c2190013b0263e749\",\"lessThan\":\"4abc8c07a065ecf771827bde3c63fbbe4aa0c08b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ea0a69ca21bbddab5b3979c2190013b0263e749\",\"lessThan\":\"5d20c6f932f2758078d0454729129c894fe353e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ea0a69ca21bbddab5b3979c2190013b0263e749\",\"lessThan\":\"c0445feb80a4d0854898118fa01073701f8d356b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ea0a69ca21bbddab5b3979c2190013b0263e749\",\"lessThan\":\"60deb9f10eec5c6a20252ed36238b55d8b614a2c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.330\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.295\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.260\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.215\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.142\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.66\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.8\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.19\",\"versionEndExcluding\":\"4.9.330\",\"matchCriteriaId\":\"2E7D435A-EF3D-42C9-9367-7A1A2E90BBC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.295\",\"matchCriteriaId\":\"E1EEFD21-64A9-49E5-BE6C-53761F46346C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.260\",\"matchCriteriaId\":\"64E35573-7CA4-4480-9B5B-E71B652A966F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.215\",\"matchCriteriaId\":\"B15615EA-D0B2-4F05-879B-7FF9B900DA1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.142\",\"matchCriteriaId\":\"D44AD643-5591-432E-BD41-C2C737F54AC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.66\",\"matchCriteriaId\":\"52AE7E2B-7BE3-4B8A-89CC-AB62434899A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.8\",\"matchCriteriaId\":\"7FEC7656-4CE2-424C-8830-EDB160E701C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8BD11A3-8643-49B6-BADE-5029A0117325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0AD220-F6A9-4012-8636-155F1B841FAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A46498B3-78E1-4623-AAE1-94D29A42BE4E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4abc8c07a065ecf771827bde3c63fbbe4aa0c08b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d20c6f932f2758078d0454729129c894fe353e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60deb9f10eec5c6a20252ed36238b55d8b614a2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6eb181a64fdabf10be9e54de728876667da20255\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78a07732fbb0934d14827d8f09b9aa6a49ee1aa9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0445feb80a4d0854898118fa01073701f8d356b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e0ff39448cea654843744c72c6780293c5082cb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:42:36+00:00",
      "cve": "CVE-2022-49934",
      "id": "CVE-2022-49934",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "321",
      "product_status:known_affected": "80",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: Fix UAF in ieee80211_scan_rx()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49934.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:27:59Z",
      "cve": "CVE-2022-49934",
      "id": "CVE-2022-49934",
      "initial_release_date": "2025-06-19T03:46:10Z",
      "product_status:known_affected": "501",
      "product_status:known_not_affected": "187",
      "product_status:recommended": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49934",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49934.json",
      "version": "57"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.