CVE-2022-49500 (GCVE-0-2022-49500)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-08-05 08:55
VLAI
Title
wl1251: dynamically allocate memory used for DMA
Summary
In the Linux kernel, the following vulnerability has been resolved: wl1251: dynamically allocate memory used for DMA With introduction of vmap'ed stacks, stack parameters can no longer be used for DMA and now leads to kernel panic. It happens at several places for the wl1251 (e.g. when accessed through SDIO) making it unuseable on e.g. the OpenPandora. We solve this by allocating temporary buffers or use wl1251_read32(). Tested on v5.18-rc5 with OpenPandora.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a1c510d0adc604bb143c86052bc5be48cbcfa17c , < da03bbfbf5acd1ab0b074617e865ad1e8a5779ef (git)
Affected: a1c510d0adc604bb143c86052bc5be48cbcfa17c , < 454744754cbf2c21b3fc7344e46e10bee2768094 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ti/wl1251/event.c",
            "drivers/net/wireless/ti/wl1251/io.c",
            "drivers/net/wireless/ti/wl1251/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "da03bbfbf5acd1ab0b074617e865ad1e8a5779ef",
              "status": "affected",
              "version": "a1c510d0adc604bb143c86052bc5be48cbcfa17c",
              "versionType": "git"
            },
            {
              "lessThan": "454744754cbf2c21b3fc7344e46e10bee2768094",
              "status": "affected",
              "version": "a1c510d0adc604bb143c86052bc5be48cbcfa17c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ti/wl1251/event.c",
            "drivers/net/wireless/ti/wl1251/io.c",
            "drivers/net/wireless/ti/wl1251/tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwl1251: dynamically allocate memory used for DMA\n\nWith introduction of vmap\u0027ed stacks, stack parameters can no\nlonger be used for DMA and now leads to kernel panic.\n\nIt happens at several places for the wl1251 (e.g. when\naccessed through SDIO) making it unuseable on e.g. the\nOpenPandora.\n\nWe solve this by allocating temporary buffers or use wl1251_read32().\n\nTested on v5.18-rc5 with OpenPandora."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable DMA-to-stack paths run in wl1251 IRQ work on TX-result and firmware event mailbox reads; an on-channel attacker can induce those interrupts via wireless activity (deauth/BSS loss, beacon loss, or elicited TX completions), matching Adjacent WiFi reachability used for other wl1251 CVEs.\nAC:L - With VMAP_STACK (default where supported), any SDIO/SPI DMA through the stack-backed buffers deterministically mis-translates via virt_to_page and corrupts host memory; an adjacent attacker can reliably force TX-result/event handling without races or attacker-uncontrollable layout conditions.\nPR:N - TX-complete and event-handle run in driver IRQ/worker context with no credential or capability check on the wireless trigger path; a radio-adjacent attacker needs no account or privileges on the victim.\nUI:N - Once the wl1251 interface is operating, firmware interrupts and completion processing run automatically; the attacker does not need the victim to mount, open a device, or otherwise interact.\nS:U - Corruption stays in host kernel memory managed by the same OS security authority; this is not a VM escape or intentional IOMMU/DMA isolation boundary bypass.\nC:H - DMA into a VMAP stack buffer uses virt_to_page on a non-linear address, so device DMA writes into the wrong physical page; that kernel memory corruption is defensibly leveraged for arbitrary disclosure under high-severity tie-break (same class as other DMA-to-stack scores).\nI:H - The same wrong-page DMA write (and related stack/cacheline hazards on DMA-capable SDIO/SPI) corrupts arbitrary host kernel memory and can yield write/control-flow primitives, so integrity impact is High.\nA:H - The fix commit documents kernel panic from this DMA-to-stack misuse on SDIO platforms (e.g. OpenPandora), and wrong-page DMA corruption can oops/panic the kernel even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:22.523Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/da03bbfbf5acd1ab0b074617e865ad1e8a5779ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/454744754cbf2c21b3fc7344e46e10bee2768094"
        }
      ],
      "title": "wl1251: dynamically allocate memory used for DMA",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49500",
    "datePublished": "2025-02-26T02:13:34.223Z",
    "dateReserved": "2025-02-26T02:08:31.586Z",
    "dateUpdated": "2026-08-05T08:55:22.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49500",
      "date": "2026-08-27",
      "epss": "0.00266",
      "percentile": "0.18075"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49500\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:26.163\",\"lastModified\":\"2026-08-04T10:17:49.600\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwl1251: dynamically allocate memory used for DMA\\n\\nWith introduction of vmap\u0027ed stacks, stack parameters can no\\nlonger be used for DMA and now leads to kernel panic.\\n\\nIt happens at several places for the wl1251 (e.g. when\\naccessed through SDIO) making it unuseable on e.g. the\\nOpenPandora.\\n\\nWe solve this by allocating temporary buffers or use wl1251_read32().\\n\\nTested on v5.18-rc5 with OpenPandora.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wl1251: asignar din\u00e1micamente memoria utilizada para DMA Con la introducci\u00f3n de pilas vmap\u0027ed, los par\u00e1metros de pila ya no se pueden utilizar para DMA y ahora provoca un p\u00e1nico del kernel. Sucede en varios lugares para wl1251 (por ejemplo, cuando se accede a trav\u00e9s de SDIO), lo que lo hace inutilizable en, por ejemplo, OpenPandora. Solucionamos esto asignando b\u00faferes temporales o utilizando wl1251_read32(). Probado en v5.18-rc5 con OpenPandora.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/ti/wl1251/event.c\",\"drivers/net/wireless/ti/wl1251/io.c\",\"drivers/net/wireless/ti/wl1251/tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a1c510d0adc604bb143c86052bc5be48cbcfa17c\",\"lessThan\":\"da03bbfbf5acd1ab0b074617e865ad1e8a5779ef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a1c510d0adc604bb143c86052bc5be48cbcfa17c\",\"lessThan\":\"454744754cbf2c21b3fc7344e46e10bee2768094\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/ti/wl1251/event.c\",\"drivers/net/wireless/ti/wl1251/io.c\",\"drivers/net/wireless/ti/wl1251/tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/454744754cbf2c21b3fc7344e46e10bee2768094\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da03bbfbf5acd1ab0b074617e865ad1e8a5779ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:43:40+00:00",
      "cve": "CVE-2022-49500",
      "id": "CVE-2022-49500",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wl1251: dynamically allocate memory used for DMA",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49500.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T16:50:12Z",
      "cve": "CVE-2022-49500",
      "id": "CVE-2022-49500",
      "initial_release_date": "2025-02-27T03:05:54Z",
      "product_status:known_not_affected": "352",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49500",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49500.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.