CVE-2022-50179
published 2025-06-18CVE-2022-50179: In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
11.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
problem was in incorrect htc_handle->drv_priv initialization.
Probable call trace which can trigger use-after-free:
ath9k_htc_probe_device()
/* htc_handle->drv_priv = priv; */
ath9k_htc_wait_for_target()
...
ath9k_hif_usb_rx_cb()
ath9k_hif_usb_rx_stream()
RX_STAT_INC() drv_priv access
In order to not add fancy protection for drv_priv we can move
htc_handle->drv_priv initialization at the end of the
ath9k_htc_probe_device() and add helper macro to make
all *_STAT_* macros NULL safe, since syzbot has reported related NULL
deref in that macros [1]
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e | 62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < ab7a0ddf5f1cdec63cb21840369873806fc36d80 | ab7a0ddf5f1cdec63cb21840369873806fc36d80 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < e9e21206b8ea62220b486310c61277e7ebfe7cec | e9e21206b8ea62220b486310c61277e7ebfe7cec |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < eccd7c3e2596b574241a7670b5b53f5322f470e5 | eccd7c3e2596b574241a7670b5b53f5322f470e5 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 03ca957c5f7b55660957eda20b5db4110319ac7a | 03ca957c5f7b55660957eda20b5db4110319ac7a |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6 | 6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < b66ebac40f64336ae2d053883bee85261060bd27 | b66ebac40f64336ae2d053883bee85261060bd27 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 | 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 4.4.0-276.310 | 4.4.0-276.310 |
| linux | linux_kernel | >= 2.6.35 < 4.14.291 | 4.14.291 |
| linux | linux_kernel | >= 4.15 < 4.19.256 | 4.19.256 |
| linux | linux_kernel | >= 4.20 < 5.4.211 | 5.4.211 |
| linux | linux_kernel | >= 5.11 < 5.15.61 | 5.15.61 |
| linux | linux_kernel | >= 5.16 < 5.18.18 | 5.18.18 |
| linux | linux_kernel | >= 5.19 < 5.19.2 | 5.19.2 |
| linux | linux_kernel | >= 5.5 < 5.10.137 | 5.10.137 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
vendor_redhat·2025-06-18·CVSS 7.8
CVE-2022-50179 [HIGH] CWE-763 kernel: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
kernel: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
In the Linux kernel, the following vulnerability has been resolved:
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
problem was in incorrect htc_handle->drv_priv initialization.
Probable call trace which can trigger use-after-free:
ath9k_htc_probe_device()
/* htc_handle->drv_priv = priv; */
ath9k_htc_wait_for_target()
...
ath9k_hif_usb_rx_cb()
ath9k_hif_usb_rx_stream()
RX_STAT_INC()drv_priv access
In order to not add fancy protection for drv_priv we can move
htc_handle->drv_priv initialization at the end of the
ath9k_htc_probe_device() and add helper macro to make
all *_STAT_* macros NULL safe, since syzbot has reported related NULL
deref in that macros [1]
Pack
Debian
CVE-2022-50179: linux - In the Linux kernel, the following vulnerability has been resolved: ath9k: fix ...
vendor_debian·2022·CVSS 7.8
CVE-2022-50179 [HIGH] CVE-2022-50179: linux - In the Linux kernel, the following vulnerability has been resolved: ath9k: fix ...
In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; */ ath9k_htc_wait_for_target() ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: r
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2025-12-15·CVSS 5.5
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- ACPI drivers;
- Hardware monitoring drivers;
- InfiniBand drivers;
- MTD block device drivers;
- Network drivers;
- DesignWare USB3 driver;
- Ceph distributed file system;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File systems infrastructure;
- Tracing infrastructure;
- Appletalk network protocol;
- IPv6 networking;
- Netfilter;
(CVE-2021-47146, CVE-2021-47269, CVE-2021-47385, CVE-2021-47634,
CVE-2022-49026, CVE-2024-49935, CVE-2024-50067, CVE-2024-50095,
CVE-2024-50179, CVE-2024-53112, CVE-2024-53217, C
OSV
linux-fips vulnerabilities
osv·2025-12-15·CVSS 5.5
linux-fips vulnerabilities
linux-fips vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- ACPI drivers;
- Hardware monitoring drivers;
- InfiniBand drivers;
- MTD block device drivers;
- Network drivers;
- DesignWare USB3 driver;
- Ceph distributed file system;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File systems infrastructure;
- Tracing infrastructure;
- Appletalk network protocol;
- IPv6 networking;
- Netfilter;
(CVE-2021-47146, CVE-2021-47269, CVE-2021-47385, CVE-2021-47634,
CVE-2022-49026, CVE-2024-49935, CVE-2024-50067, CVE-2024-50095,
CVE-2024-50179, CVE-2024-53112, CVE-2024-53217, CVE-2025-21715,
CVE-2025-21722, CVE-
OSV
linux-gcp-fips vulnerabilities
osv·2025-12-04·CVSS 5.5
linux-gcp-fips vulnerabilities
linux-gcp-fips vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- ACPI drivers;
- Hardware monitoring drivers;
- InfiniBand drivers;
- Mailbox framework;
- Network drivers;
- AFS file system;
- Ceph distributed file system;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File systems infrastructure;
- KVM subsystem;
- L3 Master device support module;
- Tracing infrastructure;
- Memory management;
- Appletalk network protocol;
- Netfilter;
- Open vSwitch;
(CVE-2021-47385, CVE-2022-49026, CVE-2022-49390, CVE-2024-49935,
CVE-2024-49963, CVE-2024-50067, CVE-2024-50095, CVE-2024-50179,
CVE-2024-53090, CVE-2024
OSV
linux-gcp, linux-gcp-4.15, linux-hwe vulnerabilities
osv·2025-12-04·CVSS 5.5
linux-gcp, linux-gcp-4.15, linux-hwe vulnerabilities
linux-gcp, linux-gcp-4.15, linux-hwe vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- ACPI drivers;
- Hardware monitoring drivers;
- InfiniBand drivers;
- Mailbox framework;
- Network drivers;
- AFS file system;
- Ceph distributed file system;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File systems infrastructure;
- KVM subsystem;
- L3 Master device support module;
- Tracing infrastructure;
- Memory management;
- Appletalk network protocol;
- Netfilter;
- Open vSwitch;
(CVE-2021-47385, CVE-2022-49026, CVE-2022-49390, CVE-2024-49935,
CVE-2024-49963, CVE-2024-50067, CVE-2024-50095, CVE-2024-50179,
CV
OSV
linux-aws-fips, linux-fips vulnerabilities
osv·2025-12-03·CVSS 5.5
linux-aws-fips, linux-fips vulnerabilities
linux-aws-fips, linux-fips vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- ACPI drivers;
- Hardware monitoring drivers;
- InfiniBand drivers;
- Mailbox framework;
- Network drivers;
- AFS file system;
- Ceph distributed file system;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File systems infrastructure;
- KVM subsystem;
- L3 Master device support module;
- Tracing infrastructure;
- Memory management;
- Appletalk network protocol;
- Netfilter;
- Open vSwitch;
(CVE-2021-47385, CVE-2022-49026, CVE-2022-49390, CVE-2024-49935,
CVE-2024-49963, CVE-2024-50067, CVE-2024-50095, CVE-2024-50179,
CVE-2024-530
GHSA
GHSA-92cx-cg65-38vh: In the Linux kernel, the following vulnerability has been resolved:
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Syzbot reported use-after-free
ghsa_unreviewed·2025-06-18
CVE-2022-50179 [HIGH] CWE-416 GHSA-92cx-cg65-38vh: In the Linux kernel, the following vulnerability has been resolved:
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Syzbot reported use-after-free
In the Linux kernel, the following vulnerability has been resolved:
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
problem was in incorrect htc_handle->drv_priv initialization.
Probable call trace which can trigger use-after-free:
ath9k_htc_probe_device()
/* htc_handle->drv_priv = priv; */
ath9k_htc_wait_for_target()
...
ath9k_hif_usb_rx_cb()
ath9k_hif_usb_rx_stream()
RX_STAT_INC() drv_priv access
In order to not add fancy protection for drv_priv we can move
htc_handle->drv_priv initialization at the end of the
ath9k_htc_probe_device() and add helper macro to make
all *_STAT_* macros NULL safe, since syzbot has reported related NULL
deref in that macros [1]
OSV
CVE-2022-50179: In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Re
osv·2025-06-18·CVSS 7.8
CVE-2022-50179 [HIGH] CVE-2022-50179: In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Re
In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; */ ath9k_htc_wait_for_target() ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/03ca957c5f7b55660957eda20b5db4110319ac7ahttps://git.kernel.org/stable/c/0ac4827f78c7ffe8eef074bc010e7e34bc22f533https://git.kernel.org/stable/c/62bc1ea5c7401d77eaf73d0c6a15f3d2e742856ehttps://git.kernel.org/stable/c/6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6https://git.kernel.org/stable/c/ab7a0ddf5f1cdec63cb21840369873806fc36d80https://git.kernel.org/stable/c/b66ebac40f64336ae2d053883bee85261060bd27https://git.kernel.org/stable/c/e9e21206b8ea62220b486310c61277e7ebfe7cechttps://git.kernel.org/stable/c/eccd7c3e2596b574241a7670b5b53f5322f470e5
2025-06-18
Published