In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f cve-icon cve-icon
https://git.kernel.org/stable/c/355f16f756aad0c95cdaa0c14a34ab4137d32815 cve-icon cve-icon
https://git.kernel.org/stable/c/53b9bb1a00c4285ee7f58a11129dbea015db61bc cve-icon cve-icon
https://git.kernel.org/stable/c/5e8751a977a49a6e00cce1a8da5ca16da83f9c8c cve-icon cve-icon
https://git.kernel.org/stable/c/71fc0ad671a62c494d2aec731baeabd3bfe6c95d cve-icon cve-icon
https://git.kernel.org/stable/c/988bd27de2484faf17afe0408db2e3d9e5ac61fc cve-icon cve-icon
https://git.kernel.org/stable/c/98d9172822dc6f38138333941984bd759a89d419 cve-icon cve-icon
https://git.kernel.org/stable/c/dd95f2239fc846795fc926787c3ae0ca701c9840 cve-icon cve-icon
https://git.kernel.org/stable/c/f127c2b4c967025e5c3a4ce7e13b79135d46a33d cve-icon cve-icon
History

Tue, 30 Dec 2025 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Title wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-30T12:10:51.434Z

Reserved: 2025-12-30T12:06:07.132Z

Link: CVE-2022-50829

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2025-12-30T13:15:57.377

Modified: 2025-12-30T13:15:57.377

Link: CVE-2022-50829

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.