CVE-2022-50831
Unknown Unknown - Not Provided
Use-After-Free in Linux Kernel mac80211 Multi-BSSID Parsing

Publication date: 2025-12-30

Last updated on: 2025-12-30

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MBSSID parsing use-after-free commit ff05d4b45dd89b922578dac497dcabf57cf771c6 When we parse a multi-BSSID element, we might point some element pointers into the allocated nontransmitted_profile. However, we free this before returning, causing UAF when the relevant pointers in the parsed elements are accessed. Fix this by not allocating the scratch buffer separately but as part of the returned structure instead, that way, there are no lifetime issues with it. The scratch buffer introduction as part of the returned data here is taken from MLO feature work done by Ilan. This fixes CVE-2022-42719.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-30
Last Modified
2025-12-30
Generated
2026-05-07
AI Q&A
2025-12-30
EPSS Evaluated
N/A
NVD
CVE-2022-50831
EUVD
EUVD-2022-55867
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's wifi mac80211 component when parsing multi-BSSID elements. Specifically, pointers to elements are set into an allocated buffer that is freed before the function returns, leading to UAF when those pointers are accessed later. The fix involves changing the allocation method to include the scratch buffer as part of the returned structure to avoid lifetime issues.


How can this vulnerability impact me? :

The use-after-free vulnerability can lead to undefined behavior such as crashes or potential exploitation by attackers to execute arbitrary code or cause denial of service in the Linux kernel's wifi subsystem.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart