{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50732","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-24T12:20:40.331Z","datePublished":"2025-12-24T12:22:51.933Z","dateUpdated":"2026-08-05T08:59:31.519Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:59:31.519Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8192u: Fix use after free in ieee80211_rx()\n\nWe cannot dereference the \"skb\" pointer after calling\nieee80211_monitor_rx(), because it is a use after free."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The UAF is in the rtl8192u 802.11 RX path (USB ISR → tasklet → rtl8192_rx_nomal → ieee80211_rx) and is triggered by over-the-air WiFi frames while the adapter is in monitor mode, so the attacker must be on the same RF/LAN segment (WiFi frame injection = Adjacent).\nAC:L - Once the interface is in monitor mode, any received frame takes the ieee80211_monitor_rx → netif_rx(skb) path and then reads skb->len; an adjacent attacker can flood frames to force backlog drops (kfree_skb) or RPS cross-CPU reclaim, so the UAF is reliably attacker-driven with no uncontrollable race.\nPR:N - Frame delivery runs in the driver softirq/tasklet with no host authentication or capability check; the attacker needs no account on the victim and only needs to inject WiFi frames toward a monitor-mode RTL8192U interface.\nUI:N - In the worst reasonable deployment (WiFi monitoring/IDS/pentest with the dongle already in monitor mode), frames are processed automatically in kernel RX context with no further victim action such as opening a file or confirming a prompt.\nS:U - The sk_buff use-after-free corrupts host kernel heap state within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After netif_rx() hands off the skb it may be freed (backlog drop or RPS on another CPU) before the dangling skb->len read, enabling reclaim of the sk_buff slab object and disclosure of reused kernel memory, scored High per UAF guidance (same pattern as CVE-2023-53432).\nI:H - Use-after-free of a general-purpose sk_buff slab object is a classic heap-grooming primitive that can yield attacker-controlled object reuse and control-flow hijacking, so integrity impact is High per kernel UAF scoring guidance.\nA:H - Dereferencing a freed sk_buff can oops/panic the kernel, and an adjacent attacker can repeatedly inject frames to crash the host at will."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c"],"versions":[{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"9c03db0ec84b7964a11b20706665c99a5fead332","status":"affected","versionType":"git"},{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"fdc62d31d50e4ce5d8f363fcb8299ba0e00ee6fd","status":"affected","versionType":"git"},{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"a0df8d44b555ae09729d6533fd4532977563c7b9","status":"affected","versionType":"git"},{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"288ada16a93aab5aa2ebea8190aafdb35b716854","status":"affected","versionType":"git"},{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"daa8045a991363ccdae5615d170f35aa1135e7a7","status":"affected","versionType":"git"},{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"b0aaec894a909c88117c8bda6c7c9b26cf7c744b","status":"affected","versionType":"git"},{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"de174163c0d319ff06d622e79130a0017c8f5a6e","status":"affected","versionType":"git"},{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"73df1172bbcc8d45cd28e3b1a9ca2edb2f9f7ce6","status":"affected","versionType":"git"},{"version":"8fc8598e61f6f384f3eaf1d9b09500c12af47b37","lessThan":"bcc5e2dcf09089b337b76fc1a589f6ff95ca19ac","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c"],"versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","status":"unaffected","versionType":"semver"},{"version":"4.9.337","lessThanOrEqual":"4.9.*","status":"unaffected","versionType":"semver"},{"version":"4.14.303","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.270","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.229","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.163","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.86","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.0.16","lessThanOrEqual":"6.0.*","status":"unaffected","versionType":"semver"},{"version":"6.1.2","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"4.9.337"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"4.14.303"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"4.19.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"5.4.229"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"5.10.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"5.15.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.0.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.1.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33","versionEndExcluding":"6.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9c03db0ec84b7964a11b20706665c99a5fead332"},{"url":"https://git.kernel.org/stable/c/fdc62d31d50e4ce5d8f363fcb8299ba0e00ee6fd"},{"url":"https://git.kernel.org/stable/c/a0df8d44b555ae09729d6533fd4532977563c7b9"},{"url":"https://git.kernel.org/stable/c/288ada16a93aab5aa2ebea8190aafdb35b716854"},{"url":"https://git.kernel.org/stable/c/daa8045a991363ccdae5615d170f35aa1135e7a7"},{"url":"https://git.kernel.org/stable/c/b0aaec894a909c88117c8bda6c7c9b26cf7c744b"},{"url":"https://git.kernel.org/stable/c/de174163c0d319ff06d622e79130a0017c8f5a6e"},{"url":"https://git.kernel.org/stable/c/73df1172bbcc8d45cd28e3b1a9ca2edb2f9f7ce6"},{"url":"https://git.kernel.org/stable/c/bcc5e2dcf09089b337b76fc1a589f6ff95ca19ac"}],"title":"staging: rtl8192u: Fix use after free in ieee80211_rx()","x_generator":{"engine":"bippy-1.2.0"}}}}