CVE-2022-49479

A flaw was found in the mt76 component of the Linux kernel. A race condition exists during ongoing transmit activity, where a network packet (skb) can be added to a status tracking identifier (idr) after the identifier has already been deallocated. This use-after-free vulnerability could allow a local attacker to cause a denial of service, leading to system instability or crashes. In some scenarios, this type of flaw could also potentially lead to arbitrary code execution.

This vulnerability is evaluated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires a system configured with active MediaTek wireless hardware and local access to hit a narrow race window. Typical enterprise server deployments do not utilize Wi-Fi interfaces, which significantly limits real-world exposure across standard environments. Furthermore, successfully triggering this flaw requires local privileges during concurrent station disconnection and data transmission, primarily resulting in a kernel denial of service rather than reliable privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.