CVE-2022-49023: wifi: cfg80211: fix buffer overflow in elem comparison

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel5.1 and later · before 5.4.226
• linux linux kernel5.5 and later · before 5.10.158
• linux linux kernel5.11 and later · before 5.15.82
• linux linux kernel5.16 and later · before 6.0.12
• linux linux kernel6.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 5.1affected
  • 0b8fb8235be8be99a197e8d948fc0a2df8dc261a and later · before f5c2ec288a865dbe3706b09bed12302e9f6d696baffected · git
  • 0b8fb8235be8be99a197e8d948fc0a2df8dc261a and later · before 9e6b79a3cd17620d467311b30d56f2648f6880aaaffected · git
  • 0b8fb8235be8be99a197e8d948fc0a2df8dc261a and later · before 88a6fe3707888bd1893e9741157a7035c4159ab6affected · git
  • 0b8fb8235be8be99a197e8d948fc0a2df8dc261a and later · before 391cb872553627bdcf236c03ee7d5adb275e37e1affected · git
  • 0b8fb8235be8be99a197e8d948fc0a2df8dc261a and later · before 9f16b5c82a025cd4c864737409234ddc44fb166aaffected · git
  • before 5.1not affected · semver
  • 5.4.226 and later · up to and including 5.4.*not affected · semver
  • 5.10.158 and later · up to and including 5.10.*not affected · semver
  • 5.15.82 and later · up to and including 5.15.*not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2022-49021Oct 21, 2024 · net: phy: fix null-ptr-deref while probe() failed
  22Monitor
• ← EarlierCVE-2022-49022Oct 21, 2024 · wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
  31Monitor
• Later →CVE-2022-49024Oct 21, 2024 · can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.