{
  "cveId": "CVE-2022-49326",
  "url": "https://patchblox.com/security/cve/CVE-2022-49326",
  "summary": "CVE-2022-49326 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49326, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  rtl818x: Prevent using not initialized queues  U...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  rtl818x: Prevent using not initialized queues  Using not existing queues can panic the kernel with rtl8180/rtl8185 cards. Ignore the skb priority for those cards, they only have one tx queue. Pierre Asselin (pa@panix.com) reported the kernel crash in the Gentoo forum:  https://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html  He also confirmed that this patch fixes the issue. In summary this happened:  After updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a \u0022divide error: 0000\u0022 when connecting to an AP. Control port tx now tries to use IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in 2.10.  Since only the rtl8187se part of the driver supports QoS, the priority of the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185 cards.  rtl8180 is then unconditionally reading out the priority and finally crashes on drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this patch: \tidx = (ring-\u003Eidx \u002B skb_queue_len(\u0026ring-\u003Equeue)) % ring-\u003Eentries  \u0022ring-\u003Eentries\u0022 is zero for rtl8180/rtl8185 cards, tx_ring[2] never got initialized.",
  "published": "2025-02-26T07:01:09Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00296,
  "epssPercentile": 0.22369,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49326",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49326",
      "released": "2025-02-26T07:01:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49326",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49326",
      "released": "2025-02-26T07:01:09Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49326",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49326",
      "released": "2025-02-26T07:01:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}