PT-2025-8466 · Linux+4 · Linux Kernel+4

Kalle Valo + 2 · Published 2022-01-01 · Updated 2026-05-26 · CVE-2022-49533

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A buffer overflow issue exists in the Linux kernel, specifically in the ath11k driver. The scan req params structure can hold a maximum of 10 SSIDs, but the driver reports a capacity of 16 SSIDs, leading to a potential buffer overflow when copying SSIDs into the structure. This issue can be triggered from wpa supplicant in userspace. The firmware supports up to 64 probe requests, with 16 SSIDs and 4 BSSIDs each.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2026-03746

CVE-2022-49533

SUSE-SU-2025:1176-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1241-1

Affected Products

Debian

Linux Kernel

Suse

Ath11K

Wpa Supplicant

References · 1305

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49533.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-49533 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49533 · Vendor Advisory
• https://git.kernel.org/stable/c/ec5dfa1d66f2f71a48dab027d26a9fa78eb0f58f · Patch
• https://ubuntu.com/security/CVE-2022-49533 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-49533 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49533 · Vendor Advisory
• https://git.kernel.org/stable/c/50dc9ce9f80554a88e33b73c30851acf2be36ed3 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49533 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03746 · Security Note
• https://git.kernel.org/stable/c/210505788f1d243232e21ef660efcd4838890ce8 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49533 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49533 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory