What is the CVSS score of CVE-2022-49238?

CVE-2022-49238 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2022-49238?

The Linux kernel ath11k Wi-Fi driver contains a use-after-free vulnerability (CVE-2022-49238) affecting systems with Qualcomm QCA6390 and WCN6855 chipsets that can cause kernel memory corruption and…. A patch is available.

How to fix or mitigate CVE-2022-49238?

Within 24 hours, audit all Linux systems to identify those using Qualcomm QCA6390 or WCN6855 Wi-Fi chipsets and document current kernel versions. Within 7 days, obtain the vendor-released kernel patch for the ath11k Wi-Fi driver and deploy it to all affected systems, prioritizing production infrastructure and internet-facing servers. Within 30 days, conduct verification scans to confirm patch deployment across the environment and generate remediation reports for security compliance documentation.

Linux Kernel CVE-2022-49238

HIGH

Use After Free (CWE-416)

2025-02-26 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Denial Of Service Linux Use After Free Memory Corruption Intel

8.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:A retained for deauth-injection path; AC:H reflects kernel heap timing and layout requirements to escalate beyond denial-of-service.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 10:56 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 10:54 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 10:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 10:23 NVD

7.8 (HIGH) 8.8 (HIGH)

Analysis Generated

Mar 28, 2026 - 18:28 vuln.today

Patch released

Mar 28, 2026 - 18:28 nvd

Patch available

CVE Published

Feb 26, 2025 - 07:01 nvd

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855

Commit b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855") is to fix firmware crash by changing the WMI command sequence, but actually skip all the peer delete operation, then it lead commit 58595c9874c6 ("ath11k: Fixing dangling pointer issue upon peer delete failure") not take effect, and then happened a use-after-free warning from KASAN. because the peer->sta is not set to NULL and then used later.

Change to only skip the WMI_PEER_DELETE_CMDID for QCA6390/WCN6855.

log of user-after-free:

[ 534.888665] BUG: KASAN: use-after-free in ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888696] Read of size 8 at addr ffff8881396bb1b8 by task rtcwake/2860

[ 534.888705] CPU: 4 PID: 2860 Comm: rtcwake Kdump: loaded Tainted: G W 5.15.0-wt-ath+ #523 [ 534.888712] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 [ 534.888716] Call Trace: [ 534.888720] <IRQ> [ 534.888726] dump_stack_lvl+0x57/0x7d [ 534.888736] print_address_description.constprop.0+0x1f/0x170 [ 534.888745] ? ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888771] kasan_report.cold+0x83/0xdf [ 534.888783] ? ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888810] ath11k_dp_rx_update_peer_stats+0x912/0xc10 [ath11k] [ 534.888840] ath11k_dp_rx_process_mon_status+0x529/0xa70 [ath11k] [ 534.888874] ? ath11k_dp_rx_mon_status_bufs_replenish+0x3f0/0x3f0 [ath11k] [ 534.888897] ? check_prev_add+0x20f0/0x20f0 [ 534.888922] ? __lock_acquire+0xb72/0x1870 [ 534.888937] ? find_held_lock+0x33/0x110 [ 534.888954] ath11k_dp_rx_process_mon_rings+0x297/0x520 [ath11k] [ 534.888981] ? rcu_read_unlock+0x40/0x40 [ 534.888990] ? ath11k_dp_rx_pdev_alloc+0xd90/0xd90 [ath11k] [ 534.889026] ath11k_dp_service_mon_ring+0x67/0xe0 [ath11k] [ 534.889053] ? ath11k_dp_rx_process_mon_rings+0x520/0x520 [ath11k] [ 534.889075] call_timer_fn+0x167/0x4a0 [ 534.889084] ? add_timer_on+0x3b0/0x3b0 [ 534.889103] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 [ 534.889117] __run_timers.part.0+0x539/0x8b0 [ 534.889123] ? ath11k_dp_rx_process_mon_rings+0x520/0x520 [ath11k] [ 534.889157] ? call_timer_fn+0x4a0/0x4a0 [ 534.889164] ? mark_lock_irq+0x1c30/0x1c30 [ 534.889173] ? clockevents_program_event+0xdd/0x280 [ 534.889189] ? mark_held_locks+0xa5/0xe0 [ 534.889203] run_timer_softirq+0x97/0x180 [ 534.889213] __do_softirq+0x276/0x86a [ 534.889230] __irq_exit_rcu+0x11c/0x180 [ 534.889238] irq_exit_rcu+0x5/0x20 [ 534.889244] sysvec_apic_timer_interrupt+0x8e/0xc0 [ 534.889251] </IRQ> [ 534.889254] <TASK> [ 534.889259] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 534.889265] RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 [ 534.889271] Code: 74 24 10 e8 ea c2 bf fd 48 89 ef e8 12 53 c0 fd 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 <e8> 13 a7 b5 fd 65 8b 05 cc d9 9c 5e 85 c0 74 0a 5b 5d c3 e8 a0 ee [ 534.889276] RSP: 0018:ffffc90002e5f880 EFLAGS: 00000206 [ 534.889284] RAX: 0000000000000006 RBX: 0000000000000200 RCX: ffffffff9f256f10 [ 534.889289] RDX: 0000000000000000 RSI: ffffffffa1c6e420 RDI: 0000000000000001 [ 534.889293] RBP: ffff8881095e6200 R08: 0000000000000001 R09: ffffffffa40d2b8f [ 534.889298] R10: fffffbfff481a571 R11: 0000000000000001 R12: ffff8881095e6e68 [ 534.889302] R13: ffffc90002e5f908 R14: 0000000000000246 R15: 0000000000000000 [ 534.889316] ? mark_lock+0xd0/0x14a0 [ 534.889332] klist_next+0x1d4/0x450 [ 534.889340] ? dpm_wait_for_subordinate+0x2d0/0x2d0 [ 534.889350] device_for_each_child+0xa8/0x140 [ 534.889360] ? device_remove_class_symlinks+0x1b0/0x1b0 [ 534.889370] ? __lock_release+0x4bd/0x9f0 [ 534.889378] ? dpm_suspend+0x26b/0x3f0 [ 534.889390] dpm_wait_for_subordinate+ ---truncated---

AnalysisAI

Use-after-free in the Linux kernel ath11k Wi-Fi driver exposes systems with Qualcomm QCA6390 or WCN6855 chipsets to kernel memory corruption when a wireless station disconnects from an AP. A prior fix commit (b4a0f54156ac) intended to prevent firmware crashes inadvertently bypassed all peer delete cleanup, leaving peer->sta as a dangling pointer subsequently dereferenced by ath11k_dp_rx_update_peer_stats during monitoring ring timer processing - confirmed by KASAN in kernel 5.15. No active exploitation is confirmed (not in CISA KEV), with EPSS at just 0.05% (14th percentile), but the kernel-level UAF class can escalate from denial-of-service to privilege escalation in skilled hands.

Technical ContextAI

The ath11k driver provides Linux kernel support for Qualcomm 802.11ax (Wi-Fi 6) chipsets including QCA6390 (present in Intel NUC 8 platforms) and WCN6855. The root cause (CWE-416, Use After Free) traces to commit b4a0f54156ac, which restructured the WMI (Wireless Management Interface) peer deletion command sequence to prevent firmware crashes on these specific chipsets - it suppressed WMI_PEER_DELETE_CMDID but also inadvertently bypassed setting peer->sta = NULL during station disconnect teardown. A compensating commit (58595c9874c6) intended to handle dangling pointers became a dead code path as a result. When the kernel's monitoring ring service timer subsequently fires and invokes ath11k_dp_rx_update_peer_stats, it dereferences the freed peer object, producing KASAN UAF at address ffff8881396bb1b8. CPE string cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* indicates all kernel versions before the stable-tree fix are in scope.

RemediationAI

Apply the upstream kernel stable-tree patches at https://git.kernel.org/stable/c/212ad7cb7d7592669c067125949e0a8e31ce6a0b and https://git.kernel.org/stable/c/400705c50bbf184794c885d1efad7fe9ccf1471a. Red Hat Enterprise Linux users should apply RHSA-2022:7683 or RHSA-2022:8267 via standard yum/dnf update channels. SUSE Linux Enterprise users should apply SUSE-SU-2025:1176 or SUSE-SU-2025:1241. As a temporary compensating control on systems that cannot immediately patch, blacklisting the ath11k kernel module by adding 'blacklist ath11k' to /etc/modprobe.d/ and running 'rmmod ath11k' prevents exploitation entirely but disables Wi-Fi on all affected QCA6390/WCN6855 hardware, requiring a wired fallback connection - an acceptable trade-off for high-security environments. Restricting physical and network adjacency to trusted parties reduces the deauth-injection attack surface without service disruption. No exact fixed kernel version number was independently confirmed from the available references beyond the two stable-tree commit hashes; consult your distribution's security advisory for the specific package version.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31