wifi: mac80211: Fix UAF in ieee80211_scan_rx()
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix UAF in ieee80211_scan_rx() ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req. Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done().
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 4.14.295, 4.19.260, 4.9.330, 5.10.142, 5.15.66, 5.19.8, 5.4.215
- CVEs
- CVE-2022-49934
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 01:00 UTC · Revision 1
Source evidence
wifi: mac80211: Fix UAF in ieee80211_scan_rx()
core-osv · Original sourcePublished 18 Jun 2025, 10:54 UTC
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix UAF in ieee80211_scan_rx() ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req. Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done().
osv:CVE-2022-49934
Kernel
Fixed versions: 4.9.330, 4.14.295, 4.19.260, 5.4.215, 5.10.142, 5.15.66, 5.19.8
Complete source record
{
"id": "0d206e1997fa7b84ad2cb15aae47e71ae5ae33a8d3e7567b3a10c351f2ae91b9",
"url": "https://osv.dev/vulnerability/CVE-2022-49934",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "wifi: mac80211: Fix UAF in ieee80211_scan_rx()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix UAF in ieee80211_scan_rx() ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req. Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done().",
"evidence": "osv:CVE-2022-49934",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.9.330",
"evidence": "/affected/1/ranges"
},
{
"value": "4.14.295",
"evidence": "/affected/1/ranges"
},
{
"value": "4.19.260",
"evidence": "/affected/1/ranges"
},
{
"value": "5.4.215",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.142",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.66",
"evidence": "/affected/1/ranges"
},
{
"value": "5.19.8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2022-49934",
"aliases": [
"CVE-2022-49934"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6ea0a69ca21bbddab5b3979c2190013b0263e749"
},
{
"fixed": "6eb181a64fdabf10be9e54de728876667da20255"
},
{
"fixed": "e0ff39448cea654843744c72c6780293c5082cb1"
},
{
"fixed": "78a07732fbb0934d14827d8f09b9aa6a49ee1aa9"
},
{
"fixed": "9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d"
},
{
"fixed": "4abc8c07a065ecf771827bde3c63fbbe4aa0c08b"
},
{
"fixed": "5d20c6f932f2758078d0454729129c894fe353e7"
},
{
"fixed": "c0445feb80a4d0854898118fa01073701f8d356b"
},
{
"fixed": "60deb9f10eec5c6a20252ed36238b55d8b614a2c"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49934.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.19.0"
},
{
"fixed": "4.9.330"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.10.0"
},
{
"fixed": "4.14.295"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.15.0"
},
{
"fixed": "4.19.260"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.20.0"
},
{
"fixed": "5.4.215"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.142"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.66"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "5.19.8"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49934.json"
}
}
],
"modified": "2026-10-28T02:30:41.127008646Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/4abc8c07a065ecf771827bde3c63fbbe4aa0c08b",
"https://git.kernel.org/stable/c/5d20c6f932f2758078d0454729129c894fe353e7",
"https://git.kernel.org/stable/c/60deb9f10eec5c6a20252ed36238b55d8b614a2c",
"https://git.kernel.org/stable/c/6eb181a64fdabf10be9e54de728876667da20255",
"https://git.kernel.org/stable/c/78a07732fbb0934d14827d8f09b9aa6a49ee1aa9",
"https://git.kernel.org/stable/c/9ad48cbf8b07f10c1e4a7a262b32a9179ae9dd2d",
"https://git.kernel.org/stable/c/c0445feb80a4d0854898118fa01073701f8d356b",
"https://git.kernel.org/stable/c/e0ff39448cea654843744c72c6780293c5082cb1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49934.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-49934",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49934.json"
}
},
"related_cves": [
{
"value": "CVE-2022-49934",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508849,
"published_at": "2025-06-18T10:54:36.161+00:00"
}