LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49968: ieee802154/adf7242: defer destroy_workqueue call

In the Linux kernel, the following vulnerability has been resolved: ieee802154/adf7242: defer destroy_workqueue call There is a possible race condition (use-after-free) like below (FREE) | (USE) adf7242_remove | adf7242_channel cancel_delayed_work_sync | destroy_workqueue (1) | adf7242_cmd_rx | mod_delayed_work (2) | The root cause for this race is that the upper layer (ieee802154) is unaware of this detaching event and the function adf7242_channel can be called without any checks. To fix this, we can add a flag write at the beginning of adf7242_remove and add flag check in adf7242_channel. Or we can just defer the destructive operation like other commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") which let the ieee802154_unregister_hw() to handle the synchronization. This patch takes the second option. runs")

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver flaw affecting the ADF7242 IEEE 802.15.4 radio path. A race during device removal can leave kernel workqueue memory freed while another path still tries to use it. Business urgency depends on whether affected kernels actually run this specific radio driver.

Executive priority

Treat as targeted kernel maintenance unless your environment uses IEEE 802.15.4 radio hardware. Prioritize normal kernel patch cycles and focused asset validation over emergency response, because exploitation evidence and severity scoring are not provided.

Technical view

The issue is a use-after-free race between adf7242_remove destroying a workqueue and adf7242_channel reaching adf7242_cmd_rx, which can call mod_delayed_work. The fix defers destroy_workqueue so ieee802154_unregister_hw handles synchronization. The CVE bundle lists affected Linux kernel versions and multiple stable commit references.

Likely exposure

Exposure is most plausible on Linux systems using the ADF7242 IEEE 802.15.4 driver or kernels where that module is present and loadable. Generic Linux servers without this hardware or driver path are likely less exposed, but source evidence does not quantify reachability.

Exploitation context

The source bundle does not show CISA KEV listing, active exploitation, exploit availability, or CVSS scoring. It describes a kernel race and use-after-free condition, but does not provide attacker prerequisites, impact boundaries, or real-world abuse evidence.

Researcher notes

Analysis should focus on driver reachability, device removal timing, and whether downstream kernels backported the synchronization change. The published record identifies the race and fix approach, but lacks CVSS, CWE, exploit status, and detailed threat prerequisites.

Mitigation direction

  • Inventory Linux kernels and whether the adf7242 driver is built or loaded.
  • Apply vendor kernel updates that include the referenced stable fixes.
  • Check Linux distribution advisories for backported patches or supported mitigations.
  • Reduce unnecessary IEEE 802.15.4/ADF7242 driver exposure where operationally possible.

Validation and detection

  • Confirm kernel package versions against vendor advisories and the CVE affected version list.
  • Check whether the adf7242 module is present, built in, or loaded.
  • Verify installed kernel changelogs include the referenced stable fix commits.
  • Document systems with matching hardware or enabled IEEE 802.15.4 support.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49968 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux58e9683d14752debc6f22daf6b23e031787df31f, 58e9683d14752debc6f22daf6b23e031787df31f, 58e9683d14752debc6f22daf6b23e031787df31f, 58e9683d14752debc6f22daf6b23e031787df31f, 58e9683d14752debc6f22daf6b23e031787df31f, 58e9683d14752debc6f22daf6b23e031787df31f, a2363e2d88bf50022ee643c49ee5d4f7e8c915eaunaffected
LinuxLinux4.18, 0, 4.19.258, 5.4.213, 5.10.142, 5.15.66, 5.19.8, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.