CVE-2022-50829
published 2025-12-30CVE-2022-50829: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that…
PriorityP424medium6.2
EPSS
0.25%
16.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.
The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < 5e8751a977a49a6e00cce1a8da5ca16da83f9c8c | 5e8751a977a49a6e00cce1a8da5ca16da83f9c8c |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < f127c2b4c967025e5c3a4ce7e13b79135d46a33d | f127c2b4c967025e5c3a4ce7e13b79135d46a33d |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < 0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f | 0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < 988bd27de2484faf17afe0408db2e3d9e5ac61fc | 988bd27de2484faf17afe0408db2e3d9e5ac61fc |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < 98d9172822dc6f38138333941984bd759a89d419 | 98d9172822dc6f38138333941984bd759a89d419 |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < 355f16f756aad0c95cdaa0c14a34ab4137d32815 | 355f16f756aad0c95cdaa0c14a34ab4137d32815 |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < 53b9bb1a00c4285ee7f58a11129dbea015db61bc | 53b9bb1a00c4285ee7f58a11129dbea015db61bc |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < 71fc0ad671a62c494d2aec731baeabd3bfe6c95d | 71fc0ad671a62c494d2aec731baeabd3bfe6c95d |
| linux | linux | >= 3deff76095c4ac4252e27c537db3041f619c23a2 < dd95f2239fc846795fc926787c3ae0ca701c9840 | dd95f2239fc846795fc926787c3ae0ca701c9840 |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 3.0.0 < 4.9.337 | 4.9.337 |
| linux | linux_kernel | >= 4.10.0 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15.0 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20.0 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11.0 < 5.15.86 | 5.15.86 |
| linux | linux_kernel | >= 5.16.0 < 6.0.16 | 6.0.16 |
| linux | linux_kernel | >= 5.5.0 < 5.10.163 | 5.10.163 |
| linux | linux_kernel | >= 6.1.0 < 6.1.2 | 6.1.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m2j8-j8ph-hxxh: In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is poss
ghsa_unreviewed·2025-12-30
CVE-2022-50829 GHSA-m2j8-j8ph-hxxh: In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is poss
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.
The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
OSV
CVE-2022-50829: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possib
osv·2025-12-30
CVE-2022-50829 CVE-2022-50829: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possib
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
OSV
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
osv·2025-12-30
CVE-2022-50829 wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.
The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Red Hat
kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
vendor_redhat·2025-12-30·CVSS 6.2
CVE-2022-50829 [MEDIUM] CWE-416 kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.
The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
A flaw was found in the ath9k USB Wi-Fi driver in the Linux kernel. I
Debian
CVE-2022-50829: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k...
vendor_debian·2022
CVE-2022-50829 CVE-2022-50829: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k...
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Scope: local
bookworm: resolved (fixed in 6.1.4-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.4-1)
sid: resolved (fixed i
No detection rules found.
No public exploits indexed.
Wiz
CVE-2022-50829 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50829 CVE-2022-50829 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50829 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.
The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Source : NVD
Published December 30, 2025
CNA Score N/A
Affected Tech
Bugzilla
CVE-2022-50829 kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
bugzilla·2025-12-30
CVE-2022-50829 [MEDIUM] CVE-2022-50829 kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
CVE-2022-50829 kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.
The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Discussion:
Upstream advisory:
https://lore.kerne
https://git.kernel.org/stable/c/0c8dd2ea4b419da96ab4953e4967e9363e2f8a4fhttps://git.kernel.org/stable/c/355f16f756aad0c95cdaa0c14a34ab4137d32815https://git.kernel.org/stable/c/53b9bb1a00c4285ee7f58a11129dbea015db61bchttps://git.kernel.org/stable/c/5e8751a977a49a6e00cce1a8da5ca16da83f9c8chttps://git.kernel.org/stable/c/71fc0ad671a62c494d2aec731baeabd3bfe6c95dhttps://git.kernel.org/stable/c/988bd27de2484faf17afe0408db2e3d9e5ac61fchttps://git.kernel.org/stable/c/98d9172822dc6f38138333941984bd759a89d419https://git.kernel.org/stable/c/dd95f2239fc846795fc926787c3ae0ca701c9840https://git.kernel.org/stable/c/f127c2b4c967025e5c3a4ce7e13b79135d46a33d
2025-12-30
Published