CVE-2022-42720

Name: CVE-2022-42720
Creator: NVD / NIST
Published: 2022-10-14T00:15:09.533+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10EPSS 0.80%

Last modified Jun 17, 2026

CVE-2022-42720 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.. EPSS estimates a 0.80% chance of exploitation in the next 30 days.

Description

Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.80%

51.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Linux	Linux Kernel	>= 5.1, < 5.4.218
Linux	Linux Kernel	>= 5.5, < 5.10.148
Linux	Linux Kernel	>= 5.11, < 5.15.74
Linux	Linux Kernel	>= 5.16, < 5.19.16
Linux	Linux Kernel	>= 6.0, < 6.0.2
Fedoraproject	Fedora	36
Fedoraproject	Fedora	37
Debian	Debian Linux	10.0
Debian	Debian Linux	11.0

References

http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.htmlThird Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2022/10/13/5Exploit, Mailing List, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1204059Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=0b7808818cb9df6680f98996b8e9a439fa7bcc2fMailing List, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00001.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2KTU5LFZNQS7YNGE56MT46VHMXL3DD2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNN3VFQPECS6D4PS6ZWD7AFXTOSJDSSR/
https://security.netapp.com/advisory/ntap-20230203-0008/Third Party Advisory
https://www.debian.org/security/2022/dsa-5257Third Party Advisory
http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.htmlThird Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2022/10/13/5Exploit, Mailing List, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1204059Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git/commit/?id=0b7808818cb9df6680f98996b8e9a439fa7bcc2fMailing List, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00001.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2KTU5LFZNQS7YNGE56MT46VHMXL3DD2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNN3VFQPECS6D4PS6ZWD7AFXTOSJDSSR/
https://security.netapp.com/advisory/ntap-20230203-0008/Third Party Advisory
https://www.debian.org/security/2022/dsa-5257Third Party Advisory

Timeline

Published: Oct 14, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-42720?

How severe is CVE-2022-42720?

CVE-2022-42720 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.80% probability of exploitation in the next 30 days.

How do I fix CVE-2022-42720?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-42720?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST