CVE-2022-42720: Debian Linux

High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 36 only; version 37 only
• Linux Linux Kernel: from 5.1, before 5.4.218 (fixed in 5.4.218); from 5.5, before 5.10.148 (fixed in 5.10.148); from 5.11, before 5.15.74 (fixed in 5.15.74); from 5.16, before 5.19.16 (fixed in 5.19.16); from 6.0, before 6.0.2 (fixed in 6.0.2)

Published 2022-10-14. Last modified 2026-06-17.