Security readout for executives and security teams
Plain-English summary
CVE-2022-49479 is a Linux kernel mt76 wireless driver race condition. During station removal, transmit-status tracking can keep using freed memory. On systems with the affected driver and kernel, a local low-privileged user could potentially cause serious confidentiality, integrity, or availability impact.
Executive priority
Treat as high priority for Linux fleets using affected wireless drivers, especially laptops, workstations, and shared systems. It is not presented as remotely exploitable in the supplied sources, but kernel memory-corruption impact warrants prompt patch tracking.
Technical view
The issue is a CWE-416 use-after-free in mt76 transmit status handling. The fix prevents status SKBs from being added after the WCID was cleared from dev->wcid during mt76_sta_pre_rcu_remove. CVSS 3.1 is 7.8, local attack vector, low complexity, low privileges, no user interaction.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with mt76 MediaTek wireless driver support in use. Systems without the mt76 driver or relevant wireless hardware are less likely to be exposed, but kernel and module inventories are needed.
Exploitation context
The CVE record does not identify active exploitation, and KEV status is false in the supplied bundle. The CVSS vector indicates local access is required. Public sources provided do not include exploit details or proof-of-concept status.
Researcher notes
The supplied description points to a race between TX status tracking and station removal cleanup. Analysis should focus on mt76 WCID lifecycle, status poll list handling, and whether downstream kernels carry equivalent stable fixes.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Check distribution advisories for backported mt76 patches.
- Prioritize systems using MediaTek mt76 wireless devices.
- If patch timing is unclear, follow vendor guidance for temporary risk reduction.
Validation and detection
- Inventory kernel versions across Linux endpoints and appliances.
- Check whether mt76 modules are present or loaded.
- Confirm vendor packages include the referenced stable commits or equivalent backports.
- Review wireless-capable systems first, especially shared or multi-user hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49479 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ef7f9f894cfd0b2e471206409a529af4a26ddd55CVE reference, Linux
- https://git.kernel.org/stable/c/ddd426d72aca4054045a9bd3b80a4ce1d398f11fCVE reference, Linux
- https://git.kernel.org/stable/c/fcfe1b5e162bf473c1d47760962cec8523c00466CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.