CVE-2022-49416

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix use-after-free in chanctx code

In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point.

However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because successful exploitation requires local privileges on systems utilizing wireless network interfaces. Typical Red Hat Enterprise Linux enterprise deployments do not include or activate Wi-Fi networking hardware, limiting exposure in standard server environments. An authenticated local user capable of triggering channel context reassignments could trigger memory corruption, leading to a system crash or potential kernel memory disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.