CVE-2022-50740

wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()

published December 24, 2025

CVSS
—
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()

Syzkaller reports a long-known leak of urbs in

ath9k_hif_usb_dealloc_tx_urbs().

The cause of the leak is that usb_get_urb() is called but usb_free_urb()

(or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or

urb->ep fields have not been initialized and usb_kill_urb() returns

immediately.

The patch removes trying to kill urbs located in hif_dev->tx.tx_buf

because hif_dev->tx.tx_buf is not supposed to contain urbs which are in

pending state (the pending urbs are stored in hif_dev->tx.tx_pending).

The tx.tx_lock is acquired so there should not be any changes in the list.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Published
2025-12-24T13:05Z
EPSS history
Timeline
  • 24 DEC 13:05Z
    wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
    cvelistv5