CVE-2022-42721: debian debian_linux Loop with Unreachable Exit Condition
Vulnerability summary
CVE-2022-42721 is a medium (CVSS 5.5) Loop with Unreachable Exit Condition vulnerability in debian debian_linux. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 31 · Related 21Timeline
- 13-10-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
Increase +0.04 pp
From 0.61% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu79 products
- backport-iwlwifi-dkmsAll versions (No fix recorded) | < 8324-0ubuntu3~20.04.5 | < 9858-0ubuntu3.1
- linux< 5.4.0-131.147 | < 5.15.0-52.58
- linux-aws< 5.4.0-1088.96 | < 5.15.0-1022.26
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.0.2-1
- debian_linuxEOL10.0 | 11.0
Alpine1 product
- linux-lts< 5.15.74-r0
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
Linux1 product
- linux_kernel≥ 5.1, < 5.19.16
5 vendors · 84 products
References
23 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.htmlThird Party AdvisoryVDB Entry
