CVE-2022-49740: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49740 is a vulnerability discovered in the Linux kernel's brcmfmac WiFi driver. The vulnerability was disclosed on March 27, 2025, and affects the channel specification handling in the Linux kernel. The issue specifically impacts the brcmfconstructchaninfo() and brcmfenablebw40_2g() functions in the brcmfmac driver (NVD).

The vulnerability is a slab-out-of-bounds read that occurs when the count value of channel specifications provided by the device is greater than the length of 'list->element[]', which is determined by the size of the 'list' allocated with kzalloc(). This can lead to buffer overflow conditions in both brcmfconstructchaninfo() and brcmfenablebw40_2g() functions. The issue was discovered using a modified version of syzkaller (NVD).

The vulnerability can result in slab-out-of-bounds reads in the kernel's WiFi subsystem, potentially leading to information disclosure or system crashes. The issue affects the kernel's ability to properly handle channel specifications in the brcmfmac driver (NVD).

The patch adds checks that make the functions free the buffer and return -EINVAL if the count value exceeds the buffer size. The negative return is properly handled by the caller functions brcmfsetupwiphybands() or brcmfcfg80211attach() (NVD).