CVE-2022-50829 | THREATINT

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

PUBLISHED Reserved 2025-12-30 | Published 2025-12-30 | Updated 2025-12-30 | Assigner Linux

Product status

Default status

unaffected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before 5e8751a977a49a6e00cce1a8da5ca16da83f9c8c

affected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before f127c2b4c967025e5c3a4ce7e13b79135d46a33d

affected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before 0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f

affected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before 988bd27de2484faf17afe0408db2e3d9e5ac61fc

affected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before 98d9172822dc6f38138333941984bd759a89d419

affected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before 355f16f756aad0c95cdaa0c14a34ab4137d32815

affected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before 53b9bb1a00c4285ee7f58a11129dbea015db61bc

affected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before 71fc0ad671a62c494d2aec731baeabd3bfe6c95d

affected

3deff76095c4ac4252e27c537db3041f619c23a2 (git) before dd95f2239fc846795fc926787c3ae0ca701c9840

affected

Default status

affected

3.0

affected

Any version before 3.0

unaffected

4.9.337 (semver)

unaffected

4.14.303 (semver)

unaffected

4.19.270 (semver)

unaffected

5.4.229 (semver)

unaffected

5.10.163 (semver)

unaffected

5.15.86 (semver)

unaffected

6.0.16 (semver)

unaffected

6.1.2 (semver)

unaffected

6.2 (original_commit_for_fix)

unaffected

References

git.kernel.org/...c/5e8751a977a49a6e00cce1a8da5ca16da83f9c8c

git.kernel.org/...c/f127c2b4c967025e5c3a4ce7e13b79135d46a33d

git.kernel.org/...c/0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f

git.kernel.org/...c/988bd27de2484faf17afe0408db2e3d9e5ac61fc

git.kernel.org/...c/98d9172822dc6f38138333941984bd759a89d419

git.kernel.org/...c/355f16f756aad0c95cdaa0c14a34ab4137d32815

git.kernel.org/...c/53b9bb1a00c4285ee7f58a11129dbea015db61bc

git.kernel.org/...c/71fc0ad671a62c494d2aec731baeabd3bfe6c95d

git.kernel.org/...c/dd95f2239fc846795fc926787c3ae0ca701c9840

cve.org (CVE-2022-50829)

nvd.nist.gov (CVE-2022-50829)

Download JSON