CVE-2022-49934

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Fix UAF in ieee80211_scan_rx()

ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req.

Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done().

This flaw is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires the presence of physical or virtual wireless networking hardware performing active scans. Enterprise server deployments typically lack Wi-Fi interfaces, greatly restricting the practical attack surface. Triggering this race condition requires precise timing during scan completion, resulting primarily in a system crash (denial of service) or potential local memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.