In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa().

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 cve-icon cve-icon
https://git.kernel.org/stable/c/1691a48aef0a82d1754b9853dae7e3f5cacdf70b cve-icon cve-icon
https://git.kernel.org/stable/c/552ba102a6898630a7d16887f29e606d6fabe508 cve-icon cve-icon
https://git.kernel.org/stable/c/66689c5c02acd4d76c28498fe220998610aec61e cve-icon cve-icon
https://git.kernel.org/stable/c/864e280cb3a9a0f5212b16ef5057c4e692f7039d cve-icon cve-icon
https://git.kernel.org/stable/c/cdb9a8da9b84800eb15506cd9363cf0cf059e677 cve-icon cve-icon
https://git.kernel.org/stable/c/d9eb37db6a28b59a95a3461450ee209654c5f95b cve-icon cve-icon
https://git.kernel.org/stable/c/dd649b49219a0388cc10fc40e4c2ea681566a780 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025061807-CVE-2022-49942-8f93@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-49942 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-49942 cve-icon
History

Fri, 20 Jun 2025 14:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Wed, 18 Jun 2025 11:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa().
Title wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-06-18T10:59:57.610Z

Reserved: 2025-06-18T10:57:27.381Z

Link: CVE-2022-49942

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-06-18T11:15:21.147

Modified: 2025-06-18T13:46:52.973

Link: CVE-2022-49942

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-06-18T00:00:00Z

Links: CVE-2022-49942 - Bugzilla