CVE-2022-49539
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
26/02/2025
Last modified:
21/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
rtw89: ser: fix CAM leaks occurring in L2 reset<br />
<br />
The CAM, meaning address CAM and bssid CAM here, will get leaks during<br />
SER (system error recover) L2 reset process and ieee80211_restart_hw()<br />
which is called by L2 reset process eventually.<br />
<br />
The normal flow would be like<br />
-> add interface (acquire 1)<br />
-> enter ips (release 1)<br />
-> leave ips (acquire 1)<br />
-> connection (occupy 1) <br />
<br />
The ieee80211_restart_hw() flow (under connection)<br />
-> ieee80211 reconfig<br />
-> add interface (acquire 1)<br />
-> leave ips (acquire 1)<br />
-> connection (occupy (A) + 2) <br />
<br />
Originally, CAM is released before HW restart only if connection is under<br />
security. Now, release CAM whatever connection it is to fix leak in (A).<br />
OTOH, check if CAM is already valid to avoid acquiring multiple times to<br />
fix (B).<br />
<br />
Besides, if AP mode, release address CAM of all stations before HW restart.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 5.18.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



