CVE-2022-50829

Not scored yetLast modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak.

The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
LinuxLinux>= 3deff76095c4ac4252e27c537db3041f619c23a2, < 5e8751a977a49a6e00cce1a8da5ca16da83f9c8c; >= 3deff76095c4ac4252e27c537db3041f619c23a2, < f127c2b4c967025e5c3a4ce7e13b79135d46a33d; >= 3deff76095c4ac4252e27c537db3041f619c23a2, < 0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f; >= 3deff76095c4ac4252e27c537db3041f619c23a2, < 988bd27de2484faf17afe0408db2e3d9e5ac61fc; >= 3deff76095c4ac4252e27c537db3041f619c23a2, < 98d9172822dc6f38138333941984bd759a89d419; >= 3deff76095c4ac4252e27c537db3041f619c23a2, < 355f16f756aad0c95cdaa0c14a34ab4137d32815; >= 3deff76095c4ac4252e27c537db3041f619c23a2, < 53b9bb1a00c4285ee7f58a11129dbea015db61bc; >= 3deff76095c4ac4252e27c537db3041f619c23a2, < 71fc0ad671a62c494d2aec731baeabd3bfe6c95d; >= 3deff76095c4ac4252e27c537db3041f619c23a2, < dd95f2239fc846795fc926787c3ae0ca701c9840
LinuxLinux3.0

References

Timeline

Published
Dec 30, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2022

CVE-2022-50830In the Linux kernel, the following vulnerability has been resolved: auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() hd4CVE-2022-50832In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() The wilc_CVE-2022-50833In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer workCVE-2022-50834In the Linux kernel, the following vulnerability has been resolved: nfc: Fix potential resource leaks nfc_get_device() take reference for CVE-2022-50835In the Linux kernel, the following vulnerability has been resolved: jbd2: add miss release buffer head in fc_do_one_pass() In fc_do_one_paCVE-2022-50836In the Linux kernel, the following vulnerability has been resolved: remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() The kfCVE-2022-50837In the Linux kernel, the following vulnerability has been resolved: net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() erroCVE-2022-50838In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() ChangheonCVE-2022-50839In the Linux kernel, the following vulnerability has been resolved: jbd2: fix potential buffer head reference count leak As in 'jbd2_fc_waCVE-2022-50840In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snic_tgt_create() Smatch reports a warCVE-2022-508417.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add overflow check for attribute size The offset addition coCVE-2022-50842In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Check whether transferred 2D BO is shmem Transferred 2D BO
CVE-2022-50829: Unscored | Vulnix