{
  "cveId": "CVE-2022-49740",
  "url": "https://patchblox.com/security/cve/CVE-2022-49740",
  "summary": "CVE-2022-49740 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49740, released March 27, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: brcmfmac: Check the count value of channel...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads  This patch fixes slab-out-of-bounds reads in brcmfmac that occur in brcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count value of channel specifications provided by the device is greater than the length of \u0027list-\u003Eelement[]\u0027, decided by the size of the \u0027list\u0027 allocated with kzalloc(). The patch adds checks that make the functions free the buffer and return -EINVAL if that is the case. Note that the negative return is handled by the caller, brcmf_setup_wiphybands() or brcmf_cfg80211_attach().  Found by a modified version of syzkaller.  Crash Report from brcmf_construct_chaninfo(): ================================================================== BUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands\u002B0x1238/0x1430 Read of size 4 at addr ffff888115f24600 by task kworker/0:2/1896  CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G        W  O      5.14.0\u002B #132 Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace:  dump_stack_lvl\u002B0x57/0x7d  print_address_description.constprop.0.cold\u002B0x93/0x334  kasan_report.cold\u002B0x83/0xdf  brcmf_setup_wiphybands\u002B0x1238/0x1430  brcmf_cfg80211_attach\u002B0x2118/0x3fd0  brcmf_attach\u002B0x389/0xd40  brcmf_usb_probe\u002B0x12de/0x1690  usb_probe_interface\u002B0x25f/0x710  really_probe\u002B0x1be/0xa90  __driver_probe_device\u002B0x2ab/0x460  driver_probe_device\u002B0x49/0x120  __device_attach_driver\u002B0x18a/0x250  bus_for_each_drv\u002B0x123/0x1a0  __device_attach\u002B0x207/0x330  bus_probe_device\u002B0x1a2/0x260  device_add\u002B0xa61/0x1ce0  usb_set_configuration\u002B0x984/0x1770  usb_generic_driver_probe\u002B0x69/0x90  usb_probe_device\u002B0x9c/0x220  really_probe\u002B0x1be/0xa90  __driver_probe_device\u002B0x2ab/0x460  driver_probe_device\u002B0x49/0x120  __device_attach_driver\u002B0x18a/0x250  bus_for_each_drv\u002B0x123/0x1a0  __device_attach\u002B0x207/0x330  bus_probe_device\u002B0x1a2/0x260  device_add\u002B0xa61/0x1ce0  usb_new_device.cold\u002B0x463/0xf66  hub_event\u002B0x10d5/0x3330  process_one_work\u002B0x873/0x13e0  worker_thread\u002B0x8b/0xd10  kthread\u002B0x379/0x450  ret_from_fork\u002B0x1f/0x30  Allocated by task 1896:  kasan_save_stack\u002B0x1b/0x40  __kasan_kmalloc\u002B0x7c/0x90  kmem_cache_alloc_trace\u002B0x19e/0x330  brcmf_setup_wiphybands\u002B0x290/0x1430  brcmf_cfg80211_attach\u002B0x2118/0x3fd0  brcmf_attach\u002B0x389/0xd40  brcmf_usb_probe\u002B0x12de/0x1690  usb_probe_interface\u002B0x25f/0x710  really_probe\u002B0x1be/0xa90  __driver_probe_device\u002B0x2ab/0x460  driver_probe_device\u002B0x49/0x120  __device_attach_driver\u002B0x18a/0x250  bus_for_each_drv\u002B0x123/0x1a0  __device_attach\u002B0x207/0x330  bus_probe_device\u002B0x1a2/0x260  device_add\u002B0xa61/0x1ce0  usb_set_configuration\u002B0x984/0x1770  usb_generic_driver_probe\u002B0x69/0x90  usb_probe_device\u002B0x9c/0x220  really_probe\u002B0x1be/0xa90  __driver_probe_device\u002B0x2ab/0x460  driver_probe_device\u002B0x49/0x120  __device_attach_driver\u002B0x18a/0x250  bus_for_each_drv\u002B0x123/0x1a0  __device_attach\u002B0x207/0x330  bus_probe_device\u002B0x1a2/0x260  device_add\u002B0xa61/0x1ce0  usb_new_device.cold\u002B0x463/0xf66  hub_event\u002B0x10d5/0x3330  process_one_work\u002B0x873/0x13e0  worker_thread\u002B0x8b/0xd10  kthread\u002B0x379/0x450  ret_from_fork\u002B0x1f/0x30  The buggy address belongs to the object at ffff888115f24000  which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1536 bytes inside of  2048-byte region [ffff888115f24000, ffff888115f24800)  Memory state around the buggy address:  ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \u003Effff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc                    ^  ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc  ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================  Crash Report from brcmf_enable_bw40_2g(): ========== ---truncated---",
  "published": "2025-03-27T17:15:38Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00199,
  "epssPercentile": 0.09726,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.11-1",
      "fix": "DEBIAN-CVE-2022-49740",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49740",
      "released": "2025-03-27T17:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.11-1",
      "fix": "DEBIAN-CVE-2022-49740",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49740",
      "released": "2025-03-27T17:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.11-1",
      "fix": "DEBIAN-CVE-2022-49740",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49740",
      "released": "2025-03-27T17:15:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}