# CVE-2022-48875: linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: sdata can be NULL during AMPDU s...

CVE-2022-48875 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48875, released August 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-48875
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0024
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 21, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: sdata can be NULL during AMPDU start  ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing.  Here a trace triggering the race with the hostapd test multi_ap_fronthaul_on_ap:  (gdb) list *drv_ampdu_action+0x46 0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396). 391             int ret = -EOPNOTSUPP; 392 393             might_sleep(); 394 395             sdata = get_bss_sdata(sdata); 396             if (!check_sdata_in_driver(sdata)) 397                     return -EIO; 398 399             trace_drv_ampdu_action(local, sdata, params); 400  wlan0: moving STA 02:00:00:00:03:00 to state 3 wlan0: associated wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port) wlan0: moving STA 02:00:00:00:03:00 to state 2 wlan0: moving STA 02:00:00:00:03:00 to state 1 wlan0: Removed STA 02:00:00:00:03:00 wlan0: Destroyed STA 02:00:00:00:03:00 BUG: unable to handle page fault for address: fffffffffffffb48 PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G        W          6.1.0-rc8-wt+ #59 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Workqueue: phy3 ieee80211_ba_session_work [mac80211] RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 FS:  0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 Call Trace:  <TASK>  ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]  ieee80211_ba_session_work+0xff/0x2e0 [mac80211]  process_one_work+0x29f/0x620  worker_thread+0x4d/0x3d0  ? process_one_work+0x620/0x620  kthread+0xfb/0x120  ? kthread_complete_and_exit+0x20/0x20  ret_from_fork+0x22/0x30  </TASK>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.8-1 | [DEBIAN-CVE-2022-48875](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48875.md) | Aug 21, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.1.8-1 | [DEBIAN-CVE-2022-48875](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48875.md) | Aug 21, 2024 |
| Linux | linux Debian 14 | 6.1.8-1 | [DEBIAN-CVE-2022-48875](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48875.md) | Aug 21, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.