CVE-2022-49315 - Vulnerability Details

- drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()

Description

In the Linux kernel, the following vulnerability has been resolved:

drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()

There is a deadlock in rtllib_beacons_stop(), which is shown
below:

(Thread 1) | (Thread 2)
| rtllib_send_beacon()
rtllib_beacons_stop() | mod_timer()
spin_lock_irqsave() //(1) | (wait a time)
... | rtllib_send_beacon_cb()
del_timer_sync() | spin_lock_irqsave() //(2)
(wait timer to stop) | ...

We hold ieee->beacon_lock in position (1) of thread 1 and
use del_timer_sync() to wait timer to stop, but timer handler
also need ieee->beacon_lock in position (2) of thread 2.
As a result, rtllib_beacons_stop() will block forever.

This patch extracts del_timer_sync() from the protection of
spin_lock_irqsave(), which could let timer handler to obtain
the needed lock.

Published: 2025-02-26

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< 4681129fda9e8555392eaaadb239ec6a6e2b3e12
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< 381045dc64d23a2229c47c5524c06bfc33d34446
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< 08bacf871c019163ccd1389d0bc957a43324967a
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< 64b05fa212c7e4d057676e8b7e7120c6eb2f615b
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< 0f69d7d5e918aa43423d86bd17ddb11b1b5e8ada
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< fef451f0fbbe85dbd2962b18379d02e2965610db
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< 46c861009bf437a18417df24cea0d181741b7d72
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< ffd4c4d5293e4985092ea45ba21cad9326e2e434
`94a799425eee8225a1e3fbe5f473d2ef04002577`	affected	< 9b6bdbd9337de3917945847bde262a34a87a6303

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`4.9.318`	unaffected	≤ 4.9.*
`4.14.283`	unaffected	≤ 4.14.*
`4.19.247`	unaffected	≤ 4.19.*
`5.4.198`	unaffected	≤ 5.4.*
`5.10.122`	unaffected	≤ 5.10.*
`5.15.47`	unaffected	≤ 5.15.*
`5.17.15`	unaffected	≤ 5.17.*
`5.18.4`	unaffected	≤ 5.18.*
`5.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-54912	In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() There is a deadlock in rtllib_beacons_stop(), which is shown below: (Thread 1) \| (Thread 2) \| rtllib_send_beacon() rtllib_beacons_stop() \| mod_timer() spin_lock_irqsave() //(1) \| (wait a time) ... \| rtllib_send_beacon_cb() del_timer_sync() \| spin_lock_irqsave() //(2) (wait timer to stop) \| ... We hold ieee->beacon_lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need ieee->beacon_lock in position (2) of thread 2. As a result, rtllib_beacons_stop() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/08bacf871c019163ccd1389d0bc957a43324967a
https://git.kernel.org/stable/c/0f69d7d5e918aa43423d86bd17ddb11b1b5e8ada
https://git.kernel.org/stable/c/381045dc64d23a2229c47c5524c06bfc33d34446
https://git.kernel.org/stable/c/4681129fda9e8555392eaaadb239ec6a6e2b3e12
https://git.kernel.org/stable/c/46c861009bf437a18417df24cea0d181741b7d72
https://git.kernel.org/stable/c/64b05fa212c7e4d057676e8b7e7120c6eb2f615b
https://git.kernel.org/stable/c/9b6bdbd9337de3917945847bde262a34a87a6303
https://git.kernel.org/stable/c/fef451f0fbbe85dbd2962b18379d02e2965610db
https://git.kernel.org/stable/c/ffd4c4d5293e4985092ea45ba21cad9326e2e434
https://lore.kernel.org/linux-cve-announce/2025022636-CVE-2022-49315-4e45@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-49315
https://www.cve.org/CVERecord?id=CVE-2022-49315

History

Wed, 01 Oct 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 13 Mar 2025 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Weaknesses		CWE-667
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel

Thu, 27 Feb 2025 13:30:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025022636-CVE-2022-49315-4e45@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2022-49315 https://www.cve.org/CVERecord?id=CVE-2022-49315
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 26 Feb 2025 02:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() There is a deadlock in rtllib_beacons_stop(), which is shown below: (Thread 1) \| (Thread 2) \| rtllib_send_beacon() rtllib_beacons_stop() \| mod_timer() spin_lock_irqsave() //(1) \| (wait a time) ... \| rtllib_send_beacon_cb() del_timer_sync() \| spin_lock_irqsave() //(2) (wait timer to stop) \| ... We hold ieee->beacon_lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need ieee->beacon_lock in position (2) of thread 2. As a result, rtllib_beacons_stop() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock.
Title		drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
References		https://git.kernel.org/stable/c/08bacf871c019163ccd1389d0bc957a43324967a https://git.kernel.org/stable/c/0f69d7d5e918aa43423d86bd17ddb11b1b5e8ada https://git.kernel.org/stable/c/381045dc64d23a2229c47c5524c06bfc33d34446 https://git.kernel.org/stable/c/4681129fda9e8555392eaaadb239ec6a6e2b3e12 https://git.kernel.org/stable/c/46c861009bf437a18417df24cea0d181741b7d72 https://git.kernel.org/stable/c/64b05fa212c7e4d057676e8b7e7120c6eb2f615b https://git.kernel.org/stable/c/9b6bdbd9337de3917945847bde262a34a87a6303 https://git.kernel.org/stable/c/fef451f0fbbe85dbd2962b18379d02e2965610db https://git.kernel.org/stable/c/ffd4c4d5293e4985092ea45ba21cad9326e2e434

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-02-26T02:10:43.082Z

Updated: 2026-05-11T18:57:19.092Z

Reserved: 2025-02-26T02:08:31.536Z

Link: CVE-2022-49315

Vulnrichment

Updated: 2025-10-01T16:14:33.138Z

NVD

Status : Modified

Published: 2025-02-26T07:01:08.373

Modified: 2025-10-01T20:16:06.040

Link: CVE-2022-49315

Redhat

Severity : Moderate

Publid Date: 2025-02-26T00:00:00Z

Links: CVE-2022-49315 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

CWE-667

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object