CVE-2022-48875— wifi: mac80211: sdata can be NULL during AMPDU start
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于 mac80211 驱动在AMPDU（Aggregated MAC Protocol Data Unit）会话开始时可能存在空指针问题。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client ExecutionAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 0ab337032a0dfcd5f2527d3306d3deeba5f95b59< 187523fa7c2d4c780f775cb869216865c4a909ef |
affected |
0ab337032a0dfcd5f2527d3306d3deeba5f95b59< a12fd43bd175fa52c82f9740179d38c34ca1b62e |
affected | ||
0ab337032a0dfcd5f2527d3306d3deeba5f95b59< c838df8461a601b20dc1b9fb1834d2aad8e2f949 |
affected | ||
0ab337032a0dfcd5f2527d3306d3deeba5f95b59< 69403bad97aa0162e3d7911b27e25abe774093df |
affected | ||
2.6.36 |
affected | ||
< 2.6.36 |
unaffected | ||
5.10.165≤ 5.10.* |
unaffected | ||
5.15.90≤ 5.15.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-48875
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wifi: mac80211: sdata can be NULL during AMPDU start
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: sdata can be NULL during AMPDU start
ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a
deauthentication is ongoing.
Here a trace triggering the race with the hostapd test
multi_ap_fronthaul_on_ap:
(gdb) list *drv_ampdu_action+0x46
0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).
391 int ret = -EOPNOTSUPP;
392
393 might_sleep();
394
395 sdata = get_bss_sdata(sdata);
396 if (!check_sdata_in_driver(sdata))
397 return -EIO;
398
399 trace_drv_ampdu_action(local, sdata, params);
400
wlan0: moving STA 02:00:00:00:03:00 to state 3
wlan0: associated
wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)
wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0
wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)
wlan0: moving STA 02:00:00:00:03:00 to state 2
wlan0: moving STA 02:00:00:00:03:00 to state 1
wlan0: Removed STA 02:00:00:00:03:00
wlan0: Destroyed STA 02:00:00:00:03:00
BUG: unable to handle page fault for address: fffffffffffffb48
PGD 11814067 P4D 11814067 PUD 11816067 PMD 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014
Workqueue: phy3 ieee80211_ba_session_work [mac80211]
RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211]
Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85
RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287
RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240
RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40
RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0
R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8
FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0
Call Trace:
<TASK>
ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]
ieee80211_ba_session_work+0xff/0x2e0 [mac80211]
process_one_work+0x29f/0x620
worker_thread+0x4d/0x3d0
? process_one_work+0x620/0x620
kthread+0xfb/0x120
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x22/0x30
</TASK>
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于 mac80211 驱动在AMPDU（Aggregated MAC Protocol Data Unit）会话开始时可能存在空指针问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-48875
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-48875
请登录查看更多情报信息。
Other References for CVE-2022-48875 (4)
Same Patch Batch · Linux · 2024-08-21 · 68 CVEs total
| CVE-2023-52910 | 8.8 HIGH | iommu/iova: Fix alloc iova overflows issue |
| CVE-2024-43881 | 8.8 HIGH | wifi: ath12k: change DMA direction while mapping reinjected packets |
| CVE-2022-48871 | 8.8 HIGH | tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer |
| CVE-2024-43878 | 8.1 HIGH | xfrm: Fix input error path memory access |
| CVE-2022-48883 | 7.8 HIGH | net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent |
| CVE-2023-52913 | 7.8 HIGH | drm/i915: Fix potential context UAFs |
| CVE-2024-43880 | 7.8 HIGH | mlxsw: spectrum_acl_erp: Fix object nesting warning |
| CVE-2022-48892 | 7.8 HIGH | sched/core: Fix use-after-free bug in dup_user_cpus_ptr() |
| CVE-2024-43877 | 7.8 HIGH | media: pci: ivtv: Add check for DMA map result |
| CVE-2024-43882 | 7.8 HIGH | exec: Fix ToCToU between perm check and set-uid/gid usage |
| CVE-2022-48899 | 7.8 HIGH | drm/virtio: Fix GEM handle creation UAF |
| CVE-2022-48872 | 7.8 HIGH | misc: fastrpc: Fix use-after-free race condition for maps |
| CVE-2022-48873 | 7.8 HIGH | misc: fastrpc: Don't remove map on creater_process and device_release |
| CVE-2022-48874 | 7.8 HIGH | misc: fastrpc: Fix use-after-free and race in fastrpc_map_find |
| CVE-2023-52903 | 7.8 HIGH | io_uring: lock overflowing for IOPOLL |
| CVE-2022-48878 | 7.8 HIGH | Bluetooth: hci_qca: Fix driver shutdown on closed serdev |
| CVE-2022-48887 | 7.8 HIGH | drm/vmwgfx: Remove rcu locks from user resources |
| CVE-2023-52907 | 7.8 HIGH | nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() |
| CVE-2024-43872 | 7.5 HIGH | RDMA/hns: Fix soft lockup under heavy CEQE load |
| CVE-2023-52909 | 7.5 HIGH | nfsd: fix handling of cached open files in nfsd4_open codepath |
Showing top 20 of 68 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria -
CVE-2026-80724
ptp: vmclock: prevent read-only mappings from becoming writa -
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver -
CVE-2026-80723
of: reserved_mem: prevent OOB when too many dynamic regions -
CVE-2026-80720
iomap: add a separate bio_set for iomap_split_ioend
Same vendor: Linux
-
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria -
CVE-2026-80724
ptp: vmclock: prevent read-only mappings from becoming writa -
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver -
CVE-2026-80723
of: reserved_mem: prevent OOB when too many dynamic regions -
CVE-2026-80720
iomap: add a separate bio_set for iomap_split_ioend
V. Comments for CVE-2022-48875
No comments yet