High severity · published Oct 13, 2022
CVE-2022-42719
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN…
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
5.2 before 5.4.219; 5.5 before 5.10.149; 5.11 before 5.15.74; 5.16 before 5.19.16; 6.0 before 6.0.2 · source: NVD
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
FE
Fedora · Fedoraproject
35; 36; 37 · source: NVD
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-42719
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-42719
packetstormsecurity.com
http://packetstormsecurity.com/files/171005/Kernel-Live-Patch-Security-Notice-LNS-0091-1.html
Mailing List
http://www.openwall.com/lists/oss-security/2022/10/13/2
Exploit
http://www.openwall.com/lists/oss-security/2022/10/13/5
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1204051
Mailing List
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=ff05d4b45dd89b922578dac497dcabf57cf771c6
Mailing List
https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability