CVE-2022-50831
Unknown Unknown - Not Provided

Use-After-Free in Linux Kernel mac80211 Multi-BSSID Parsing

Publication date: 2025-12-30

Last updated on: 2025-12-30

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MBSSID parsing use-after-free commit ff05d4b45dd89b922578dac497dcabf57cf771c6 When we parse a multi-BSSID element, we might point some element pointers into the allocated nontransmitted_profile. However, we free this before returning, causing UAF when the relevant pointers in the parsed elements are accessed. Fix this by not allocating the scratch buffer separately but as part of the returned structure instead, that way, there are no lifetime issues with it. The scratch buffer introduction as part of the returned data here is taken from MLO feature work done by Ilan. This fixes CVE-2022-42719.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-12-30
Last Modified
2025-12-30
Generated
2026-07-06
AI Q&A
2025-12-30
EPSS Evaluated
N/A
NVD
CVE-2022-50831
EUVD
EUVD-2022-55867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's wifi mac80211 component when parsing multi-BSSID elements. Specifically, pointers to elements are set into an allocated buffer that is freed before the function returns, leading to UAF when those pointers are accessed later. The fix involves changing the allocation method to include the scratch buffer as part of the returned structure to avoid lifetime issues.

Impact Analysis

The use-after-free vulnerability can lead to undefined behavior such as crashes or potential exploitation by attackers to execute arbitrary code or cause denial of service in the Linux kernel's wifi subsystem.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-50831. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart