NVD

CVE-2022-49523 Detail

Modified After Enrichment

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Description

In the Linux kernel, the following vulnerability has been resolved: ath11k: disable spectral scan during spectral deinit When ath11k modules are removed using rmmod with spectral scan enabled, crash is observed. Different crash trace is observed for each crash. Send spectral scan disable WMI command to firmware before cleaning the spectral dbring in the spectral_deinit API to avoid this crash. call trace from one of the crash observed: [ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008 [ 1252.882722] pgd = 0f42e886 [ 1252.890955] [00000008] *pgd=00000000 [ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0 [ 1253.115261] Hardware name: Generic DT based system [ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k] [ 1253.125940] LR is at 0x88e31017 [ 1253.132448] pc : [<7f9387b8>] lr : [<88e31017>] psr: a0000193 [ 1253.135488] sp : 80d01bc8 ip : 00000001 fp : 970e0000 [ 1253.141737] r10: 88e31000 r9 : 970ec000 r8 : 00000080 [ 1253.146946] r7 : 94734040 r6 : a0000113 r5 : 00000057 r4 : 00000000 [ 1253.152159] r3 : e18cb694 r2 : 00000217 r1 : 1df1f000 r0 : 00000001 [ 1253.158755] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user [ 1253.165266] Control: 10c0383d Table: 5e71006a DAC: 00000055 [ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141) [ 1253.458055] [<7f9387b8>] (ath11k_spectral_process_data [ath11k]) from [<7f917fdc>] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k]) [ 1253.466139] [<7f917fdc>] (ath11k_dbring_buffer_release_event [ath11k]) from [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k]) [ 1253.478807] [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx [ath11k]) from [<7f8fe868>] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k]) [ 1253.490699] [<7f8fe868>] (ath11k_htc_rx_completion_handler [ath11k]) from [<7f91308c>] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k]) [ 1253.502386] [<7f91308c>] (ath11k_ce_per_engine_service [ath11k]) from [<7f9a4198>] (ath11k_pci_ce_tasklet+0x28/0x80 [ath11k_pci]) [ 1253.514811] [<7f9a4198>] (ath11k_pci_ce_tasklet [ath11k_pci]) from [<8032227c>] (tasklet_action_common.constprop.2+0x64/0xe8) [ 1253.526476] [<8032227c>] (tasklet_action_common.constprop.2) from [<803021e8>] (__do_softirq+0x130/0x2d0) [ 1253.537756] [<803021e8>] (__do_softirq) from [<80322610>] (irq_exit+0xcc/0xe8) [ 1253.547304] [<80322610>] (irq_exit) from [<8036a4a4>] (__handle_domain_irq+0x60/0xb4) [ 1253.554428] [<8036a4a4>] (__handle_domain_irq) from [<805eb348>] (gic_handle_irq+0x4c/0x90) [ 1253.562321] [<805eb348>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) Tested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: 5.5 MEDIUM

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

ADP: CISA-ADP

Base Score: 5.5 MEDIUM

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL	Source(s)	Tag(s)
https://git.kernel.org/stable/c/161c64de239c7018e0295e7e0520a19f00aa32dc	kernel.org	Patch
https://git.kernel.org/stable/c/451b9076903a057b7b8d5b24dc84b3e436a1c743	kernel.org	Patch
https://git.kernel.org/stable/c/4b9c54caef58d2b55074710952cda70540722c01	kernel.org	Patch
https://git.kernel.org/stable/c/60afa4f4e1350c876d8a061182a70c224de275dd	kernel.org	Patch
https://git.kernel.org/stable/c/8f15e67af9bec5a69e815e0230a70cffddae371a	kernel.org	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	NIST CISA-ADP

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

6 change records found show changes

CVE Modified by kernel.org 8/15/2026 9:17:23 AM

Action

Type

Old Value

New Value

Changed

Affected

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath11k/spectral.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"60afa4f4e1350c876d8a061182a70c224de275dd","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"451b9076903a057b7b8d5b24dc84b3e436a1c743","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"4b9c54caef58d2b55074710952cda70540722c01","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"8f15e67af9bec5a69e815e0230a70cffddae371a","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"161c64de239c7018e0295e7e0520a19f00aa32dc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath11k/spectral.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.121","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.46","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"5.17.14","lessThanOrEqual":"5.17.*","versionType":"semver","status":"unaffected"},{"version":"5.18.3","lessThanOrEqual":"5.18.*","versionType":"semver","status":"unaffected"},{"version":"5.19","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath11k/spectral.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9d11b7bff9508101d05f06e461ab81b5f0dc90ae","lessThan":"60afa4f4e1350c876d8a061182a70c224de275dd","versionType":"git","status":"affected"},{"version":"9d11b7bff9508101d05f06e461ab81b5f0dc90ae","lessThan":"451b9076903a057b7b8d5b24dc84b3e436a1c743","versionType":"git","status":"affected"},{"version":"9d11b7bff9508101d05f06e461ab81b5f0dc90ae","lessThan":"4b9c54caef58d2b55074710952cda70540722c01","versionType":"git","status":"affected"},{"version":"9d11b7bff9508101d05f06e461ab81b5f0dc90ae","lessThan":"8f15e67af9bec5a69e815e0230a70cffddae371a","versionType":"git","status":"affected"},{"version":"9d11b7bff9508101d05f06e461ab81b5f0dc90ae","lessThan":"161c64de239c7018e0295e7e0520a19f00aa32dc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath11k/spectral.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"5.10.121","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.46","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"5.17.14","lessThanOrEqual":"5.17.*","versionType":"semver","status":"unaffected"},{"version":"5.18.3","lessThanOrEqual":"5.18.*","versionType":"semver","status":"unaffected"},{"version":"5.19","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

CVE Modified by kernel.org 6/17/2026 1:18:19 AM

Action

Type

Old Value

New Value

Added

Affected

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath11k/spectral.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"60afa4f4e1350c876d8a061182a70c224de275dd","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"451b9076903a057b7b8d5b24dc84b3e436a1c743","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"4b9c54caef58d2b55074710952cda70540722c01","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"8f15e67af9bec5a69e815e0230a70cffddae371a","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"161c64de239c7018e0295e7e0520a19f00aa32dc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath11k/spectral.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.121","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.46","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"5.17.14","lessThanOrEqual":"5.17.*","versionType":"semver","status":"unaffected"},{"version":"5.18.3","lessThanOrEqual":"5.18.*","versionType":"semver","status":"unaffected"},{"version":"5.19","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

Initial Analysis by NIST 3/17/2025 3:53:36 PM

Action	Type	New Value
Added	CVSS V3.1	AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE	CWE-476
Added	CPE Configuration	OR cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 5.11 up to (excluding) 5.15.46 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 5.16 up to (excluding) 5.17.14 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 5.18 up to (excluding) 5.18.3 cpe:2.3:o:linux:linux_kernel::::::::* versions up to (excluding) 5.10.121
Added	Reference Type	kernel.org: https://git.kernel.org/stable/c/161c64de239c7018e0295e7e0520a19f00aa32dc Types: Patch
Added	Reference Type	kernel.org: https://git.kernel.org/stable/c/451b9076903a057b7b8d5b24dc84b3e436a1c743 Types: Patch
Added	Reference Type	kernel.org: https://git.kernel.org/stable/c/4b9c54caef58d2b55074710952cda70540722c01 Types: Patch
Added	Reference Type	kernel.org: https://git.kernel.org/stable/c/60afa4f4e1350c876d8a061182a70c224de275dd Types: Patch
Added	Reference Type	kernel.org: https://git.kernel.org/stable/c/8f15e67af9bec5a69e815e0230a70cffddae371a Types: Patch

New CVE Received from kernel.org 2/26/2025 2:01:28 AM

Action	Type	New Value
Added	Description	Record truncated, showing 2048 of 2800 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: ath11k: disable spectral scan during spectral deinit When ath11k modules are removed using rmmod with spectral scan enabled, crash is observed. Different crash trace is observed for each crash. Send spectral scan disable WMI command to firmware before cleaning the spectral dbring in the spectral_deinit API to avoid this crash. call trace from one of the crash observed: [ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008 [ 1252.882722] pgd = 0f42e886 [ 1252.890955] [00000008] *pgd=00000000 [ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0 [ 1253.115261] Hardware name: Generic DT based system [ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k] [ 1253.125940] LR is at 0x88e31017 [ 1253.132448] pc : [<7f9387b8>] lr : [<88e31017>] psr: a0000193 [ 1253.135488] sp : 80d01bc8 ip : 00000001 fp : 970e0000 [ 1253.141737] r10: 88e31000 r9 : 970ec000 r8 : 00000080 [ 1253.146946] r7 : 94734040 r6 : a0000113 r5 : 00000057 r4 : 00000000 [ 1253.152159] r3 : e18cb694 r2 : 00000217 r1 : 1df1f000 r0 : 00000001 [ 1253.158755] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user [ 1253.165266] Control: 10c0383d Table: 5e71006a DAC: 00000055 [ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141) [ 1253.458055] [<7f9387b8>] (ath11k_spectral_process_data [ath11k]) from [<7f917fdc>] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k]) [ 1253.466139] [<7f917fdc>] (ath11k_dbring_buffer_release_event [ath11k]) from [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k]) [ 1253.478807] [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx [ath11k]) from [<7f8fe868>] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k]) [ 1253.490699] [<7f8fe868>] (ath11k_htc_rx_completion_handler [ath11k]) from [<7f91308c>] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k]) [ 1253.502386] [<7f91308c>] (ath11k_ce_per
Added	Reference	https://git.kernel.org/stable/c/161c64de239c7018e0295e7e0520a19f00aa32dc
Added	Reference	https://git.kernel.org/stable/c/451b9076903a057b7b8d5b24dc84b3e436a1c743
Added	Reference	https://git.kernel.org/stable/c/4b9c54caef58d2b55074710952cda70540722c01
Added	Reference	https://git.kernel.org/stable/c/60afa4f4e1350c876d8a061182a70c224de275dd
Added	Reference	https://git.kernel.org/stable/c/8f15e67af9bec5a69e815e0230a70cffddae371a

Quick Info

CVE Dictionary Entry:
CVE-2022-49523
NVD Published Date:
02/26/2025
NVD Last Modified:
08/15/2026
Source:
kernel.org

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2022-49523 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by kernel.org 8/15/2026 9:17:23 AM

CVE Modified by CISA-ADP 6/17/2026 1:18:19 AM

CVE Modified by kernel.org 6/17/2026 1:18:19 AM

CVE Modified by CISA-ADP 10/01/2025 4:16:35 PM

Initial Analysis by NIST 3/17/2025 3:53:36 PM

New CVE Received from kernel.org 2/26/2025 2:01:28 AM

Quick Info