In the Linux kernel, the following vulnerability has been resolved:
mt76: mt7921: fix crash when startup fails.
If the nic fails to start, it is possible that the reset_work has already been scheduled. Ensure the work item is canceled so we do not have use-after-free crash in case cleanup is called before the work item is executed.
This fixes crash on my x86_64 apu2 when mt7921k radio fails to work. Radio still fails, but OS does not crash.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac1260b661c2ef0d0a56680cdb5672b931b7be8f", "target": { "function": "mt7921_stop", "file": "drivers/net/wireless/mediatek/mt76/mt7921/main.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-49129-290e9b2d", "digest": { "function_hash": "326727755627729568313381363745248978231", "length": 410.0 }, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@827e7799c61b978fbc2cc9dac66cb62401b2b3f0", "target": { "function": "mt7921_stop", "file": "drivers/net/wireless/mediatek/mt76/mt7921/main.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-49129-73a42e53", "digest": { "function_hash": "326727755627729568313381363745248978231", "length": 410.0 }, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38fbe806645090c07aa97171f20fc62c3d7d3a98", "target": { "file": "drivers/net/wireless/mediatek/mt76/mt7921/main.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-49129-9614bc89", "digest": { "line_hashes": [ "248623318771901476489620515756289428734", "222497658612376796259796438376787947083", "33997066634868690567338153770477367118", "184892445305234336240982897572087362536" ], "threshold": 0.9 }, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac1260b661c2ef0d0a56680cdb5672b931b7be8f", "target": { "file": "drivers/net/wireless/mediatek/mt76/mt7921/main.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-49129-aaec66b0", "digest": { "line_hashes": [ "248623318771901476489620515756289428734", "222497658612376796259796438376787947083", "33997066634868690567338153770477367118", "184892445305234336240982897572087362536" ], "threshold": 0.9 }, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38fbe806645090c07aa97171f20fc62c3d7d3a98", "target": { "function": "mt7921_stop", "file": "drivers/net/wireless/mediatek/mt76/mt7921/main.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-49129-b49c9783", "digest": { "function_hash": "326727755627729568313381363745248978231", "length": 410.0 }, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1a5e6002ec441a3b9fb4d048b4b49ae93409a46", "target": { "function": "mt7921_stop", "file": "drivers/net/wireless/mediatek/mt76/mt7921/main.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-49129-e25dc8c8", "digest": { "function_hash": "326727755627729568313381363745248978231", "length": 410.0 }, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@827e7799c61b978fbc2cc9dac66cb62401b2b3f0", "target": { "file": "drivers/net/wireless/mediatek/mt76/mt7921/main.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-49129-e461951e", "digest": { "line_hashes": [ "248623318771901476489620515756289428734", "222497658612376796259796438376787947083", "33997066634868690567338153770477367118", "184892445305234336240982897572087362536" ], "threshold": 0.9 }, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1a5e6002ec441a3b9fb4d048b4b49ae93409a46", "target": { "file": "drivers/net/wireless/mediatek/mt76/mt7921/main.c" }, "signature_version": "v1", "deprecated": false, "id": "CVE-2022-49129-f84ed013", "digest": { "line_hashes": [ "248623318771901476489620515756289428734", "222497658612376796259796438376787947083", "33997066634868690567338153770477367118", "184892445305234336240982897572087362536" ], "threshold": 0.9 }, "signature_type": "Line" } ]