CVE-2022-50829

wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

published December 30, 2025

CVSS
—
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

It is possible that skb is freed in ath9k_htc_rx_msg(), then

usb_submit_urb() fails and we try to free skb again. It causes

use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes

NULL but rx_buf is not freed and there can be a memory leak.

The patch removes unnecessary nskb and makes skb processing more clear: it

is supposed that ath9k_htc_rx_msg() either frees old skb or passes its

managing to another callback function.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Published
2025-12-30T12:10Z
EPSS history
Timeline
  • 30 DEC 12:10Z
    wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
    cvelistv5