CVE-2022-49503: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49503 affects the Linux kernel's ath9khtc wireless driver component. The vulnerability was discovered in the handling of rxstatus->rskeyix values in the ath9kcmnrxaccept() function, where untrusted data could be passed to testbit() function potentially leading to out-of-bounds access (Kernel Commit).

The vulnerability exists in the drivers/net/wireless/ath/ath9k/common.c file at line 46 in the ath9kcmnrxaccept() function. The issue occurs when rxstatus->rskeyix is passed to testbit() without proper validation, potentially allowing access outside the intended bitmap boundaries. The fix involves adding validation to ensure rxstatus->rskeyix is within ATHKEYMAX bounds or equals ATH9KRXKEYIX_INVALID (Kernel Commit).

The vulnerability could allow an attacker to cause out-of-bounds memory access in the Linux kernel's wireless networking stack, potentially leading to system crashes or other undefined behavior (NVD).

The vulnerability has been patched in various Linux kernel versions. Ubuntu has released fixes for multiple kernel versions including 4.15.0-192.203 for Ubuntu 18.04 LTS and 5.4.0-126.142~18.04.1 for Ubuntu 18.04 LTS with HWE. Users should update their kernel to the latest available version that includes the fix (Ubuntu Security).