CVE-2022-49022

What it actually does

Out-of-bounds array access in ieee80211_get_rate_duration allows index 15 against a u16[12] array in net/mac80211/airtime.c, enabling kernel memory corruption or crash during rx/tx airtime calculation.

Why it matters to the business

Wireless Linux systems may experience sudden crashes or instability during normal network activity, leading to downtime and requiring urgent kernel updates across fleets.

How an attack unfolds

An attacker with local or adjacent network access triggers specific 802.11 rate conditions that cause ieee80211_calc_rx_airtime or ieee80211_calc_tx_airtime to call the vulnerable function, resulting in an out-of-bounds read that can be leveraged for denial of service or further kernel exploitation by espionage or financially motivated actors.

How to fix it

Apply kernel patches containing commit 0184ede0ec61b9cd075babfaa45081b1bf322234 or equivalent stable backports; rebuild and reboot to the fixed version; for affected GIT trees use a87354f09d93e95350fb45eb343dc75454387554.

How to confirm the fix worked

Verify running kernel contains the listed commit hash; reproduce wireless airtime calculations under load and confirm absence of UBSAN array-index-out-of-bounds reports in dmesg; perform regression testing of mac80211 airtime functions.

Typical attack path

1. Gain local execution or adjacent wireless presence on target Linux system
2. Trigger wireless tx/rx status processing through crafted 802.11 frames or driver activity
3. Force ieee80211_get_rate_duration to receive an out-of-range rate index
4. Cause UBSAN-detected array access violation leading to kernel panic or memory corruption

How to detect it

Search kernel logs and dmesg for UBSAN array-index-out-of-bounds messages referencing net/mac80211/airtime.c:455 and ieee80211_get_rate_duration; inspect kworker traces involving mt76_usb or mt76x02_tx_status_data; correlate with wireless interface activity preceding crashes.

• UBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47
• index 15 is out of range for type 'u16 [12]'
• ieee80211_get_rate_duration.constprop.0+0x22f/0x2a0 [mac80211]
• Workqueue: mt76 mt76u_tx_status_data [mt76_usb]

What your security team should do

• Immediately schedule kernel upgrades to the listed fixed commits on all wireless-enabled Linux hosts
• Monitor kernel logs for UBSAN out-of-bounds warnings in airtime.c as a detection signal
• Prioritize systems with mt76 or similar wireless drivers due to observed call paths
• Test patched kernels in staging environments before broad deployment