CVE-2022-49968
published 2025-06-18CVE-2022-49968: In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race condition…
PriorityP418medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.21%
11.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
ieee802154/adf7242: defer destroy_workqueue call
There is a possible race condition (use-after-free) like below
(FREE) | (USE)
adf7242_remove | adf7242_channel
cancel_delayed_work_sync |
destroy_workqueue (1) | adf7242_cmd_rx
| mod_delayed_work (2)
|
The root cause for this race is that the upper layer (ieee802154) is
unaware of this detaching event and the function adf7242_channel can
be called without any checks.
To fix this, we can add a flag write at the beginning of adf7242_remove
and add flag check in adf7242_channel. Or we can just defer the
destructive operation like other commit 3e0588c291d6 ("hamradio: defer
ax25 kfree after unregister_netdev") which let the
ieee802154_unregister_hw() to handle the synchronization. This patch
takes the second option.
runs")
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 4.17.19 < 4.18 | 4.18 |
| linux | linux | >= 58e9683d14752debc6f22daf6b23e031787df31f < dede80aaf01f4b6e8657d23726cb4a3da226ec4c | dede80aaf01f4b6e8657d23726cb4a3da226ec4c |
| linux | linux | >= 58e9683d14752debc6f22daf6b23e031787df31f < bed12d7531df1417fc92c691999ff95e03835008 | bed12d7531df1417fc92c691999ff95e03835008 |
| linux | linux | >= 58e9683d14752debc6f22daf6b23e031787df31f < 23a29932715ca43bceb2eae1bdb770995afe7271 | 23a29932715ca43bceb2eae1bdb770995afe7271 |
| linux | linux | >= 58e9683d14752debc6f22daf6b23e031787df31f < 9f8558c5c642c62c450c98c99b7d18a709fff485 | 9f8558c5c642c62c450c98c99b7d18a709fff485 |
| linux | linux | >= 58e9683d14752debc6f22daf6b23e031787df31f < 15f3b89bd521d5770d36a61fc04a77c293138ba6 | 15f3b89bd521d5770d36a61fc04a77c293138ba6 |
| linux | linux | >= 58e9683d14752debc6f22daf6b23e031787df31f < afe7116f6d3b888778ed6d95e3cf724767b9aedf | afe7116f6d3b888778ed6d95e3cf724767b9aedf |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.148-1 | 5.10.148-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 4.17.19 < 4.18 | 4.18 |
| linux | linux_kernel | >= 4.18.1 < 4.19.258 | 4.19.258 |
| linux | linux_kernel | >= 4.20 < 5.4.213 | 5.4.213 |
| linux | linux_kernel | >= 5.11 < 5.15.66 | 5.15.66 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c2cg-7w87-rjjv: In the Linux kernel, the following vulnerability has been resolved:
ieee802154/adf7242: defer destroy_workqueue call
There is a possible race condit
ghsa_unreviewed·2025-06-18
CVE-2022-49968 [MEDIUM] CWE-362 GHSA-c2cg-7w87-rjjv: In the Linux kernel, the following vulnerability has been resolved:
ieee802154/adf7242: defer destroy_workqueue call
There is a possible race condit
In the Linux kernel, the following vulnerability has been resolved:
ieee802154/adf7242: defer destroy_workqueue call
There is a possible race condition (use-after-free) like below
(FREE) | (USE)
adf7242_remove | adf7242_channel
cancel_delayed_work_sync |
destroy_workqueue (1) | adf7242_cmd_rx
| mod_delayed_work (2)
|
The root cause for this race is that the upper layer (ieee802154) is
unaware of this detaching event and the function adf7242_channel can
be called without any checks.
To fix this, we can add a flag write at the beginning of adf7242_remove
and add flag check in adf7242_channel. Or we can just defer the
destructive operation like other commit 3e0588c291d6 ("hamradio: defer
ax25 kfree after unregister_netdev") which let the
ieee802154_unregister_hw() to handle the synchroni
OSV
CVE-2022-49968: In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race conditio
osv·2025-06-18·CVSS 4.7
CVE-2022-49968 [MEDIUM] CVE-2022-49968: In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race conditio
In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race condition (use-after-free) like below (FREE) | (USE) adf7242_remove | adf7242_channel cancel_delayed_work_sync | destroy_workqueue (1) | adf7242_cmd_rx | mod_delayed_work (2) | The root cause for this race is that the upper layer (ieee802154) is unaware of this detaching event and the function adf7242_channel can be called without any checks. To fix this, we can add a flag write at the beginning of adf7242_remove and add flag check in adf7242_channel. Or we can just defer the destructive operation like other commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") which let the ieee802154_unregister_hw() to handle the synchronizatio
Red Hat
kernel: ieee802154/adf7242: defer destroy_workqueue call
vendor_redhat·2025-06-18·CVSS 4.7
CVE-2022-49968 [MEDIUM] kernel: ieee802154/adf7242: defer destroy_workqueue call
kernel: ieee802154/adf7242: defer destroy_workqueue call
In the Linux kernel, the following vulnerability has been resolved:
ieee802154/adf7242: defer destroy_workqueue call
There is a possible race condition (use-after-free) like below
(FREE) | (USE)
adf7242_remove | adf7242_channel
cancel_delayed_work_sync |
destroy_workqueue (1) | adf7242_cmd_rx
| mod_delayed_work (2)
|
The root cause for this race is that the upper layer (ieee802154) is
unaware of this detaching event and the function adf7242_channel can
be called without any checks.
To fix this, we can add a flag write at the beginning of adf7242_remove
and add flag check in adf7242_channel. Or we can just defer the
destructive operation like other commit 3e0588c291d6 ("hamradio: defer
ax25 kfree after unregister_netdev") which let t
Debian
CVE-2022-49968: linux - In the Linux kernel, the following vulnerability has been resolved: ieee802154/...
vendor_debian·2022·CVSS 4.7
CVE-2022-49968 [MEDIUM] CVE-2022-49968: linux - In the Linux kernel, the following vulnerability has been resolved: ieee802154/...
In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race condition (use-after-free) like below (FREE) | (USE) adf7242_remove | adf7242_channel cancel_delayed_work_sync | destroy_workqueue (1) | adf7242_cmd_rx | mod_delayed_work (2) | The root cause for this race is that the upper layer (ieee802154) is unaware of this detaching event and the function adf7242_channel can be called without any checks. To fix this, we can add a flag write at the beginning of adf7242_remove and add flag check in adf7242_channel. Or we can just defer the destructive operation like other commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") which let the ieee802154_unregister_hw() to handle the synchronizatio
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/15f3b89bd521d5770d36a61fc04a77c293138ba6https://git.kernel.org/stable/c/23a29932715ca43bceb2eae1bdb770995afe7271https://git.kernel.org/stable/c/9f8558c5c642c62c450c98c99b7d18a709fff485https://git.kernel.org/stable/c/afe7116f6d3b888778ed6d95e3cf724767b9aedfhttps://git.kernel.org/stable/c/bed12d7531df1417fc92c691999ff95e03835008https://git.kernel.org/stable/c/dede80aaf01f4b6e8657d23726cb4a3da226ec4c
2025-06-18
Published