CVE-2022-50829

wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

N/A

Published: December 30, 2025 at 12:10 PM UTC

Updated: June 17, 2026 at 05:24 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.0 ≤ v < 4.14.3033.0 ≤ v < 4.19.2703.0 ≤ v < 4.9.3373.0 ≤ v < 5.10.1633.0 ≤ v < 5.15.863.0 ≤ v < 5.4.2293.0 ≤ v < 6.0.163.0 ≤ v < 6.1.23.0 ≤ v < 6.23.03deff76095c4ac4252e27c537db3041f619c23a2

Vendor states this is fixed in 0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f (fixed)

Vendor states this is fixed in 355f16f756aad0c95cdaa0c14a34ab4137d32815 (fixed)

Vendor states this is fixed in 53b9bb1a00c4285ee7f58a11129dbea015db61bc (fixed)

Vendor states this is fixed in 5e8751a977a49a6e00cce1a8da5ca16da83f9c8c (fixed)

Vendor states this is fixed in 71fc0ad671a62c494d2aec731baeabd3bfe6c95d (fixed)

Vendor states this is fixed in 988bd27de2484faf17afe0408db2e3d9e5ac61fc (fixed)

Vendor states this is fixed in 98d9172822dc6f38138333941984bd759a89d419 (fixed)

Vendor states this is fixed in dd95f2239fc846795fc926787c3ae0ca701c9840 (fixed)

Vendor states this is fixed in f127c2b4c967025e5c3a4ce7e13b79135d46a33d (fixed)

Vendor states this is fixed in 3.0 (unaffected)

Vendor states this is fixed in 4.14.303 (unaffected)

Vendor states this is fixed in 4.19.270 (unaffected)