« Volver al listado

CVE-2022-50829

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak.

The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-50829",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "5e8751a977a49a6e00cce1a8da5ca16da83f9c8c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "f127c2b4c967025e5c3a4ce7e13b79135d46a33d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "988bd27de2484faf17afe0408db2e3d9e5ac61fc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "98d9172822dc6f38138333941984bd759a89d419",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "355f16f756aad0c95cdaa0c14a34ab4137d32815",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "53b9bb1a00c4285ee7f58a11129dbea015db61bc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "71fc0ad671a62c494d2aec731baeabd3bfe6c95d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3deff76095c4ac4252e27c537db3041f619c23a2",
              "lessThan": "dd95f2239fc846795fc926787c3ae0ca701c9840",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/ath/ath9k/hif_usb.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver",
              "lessThanOrEqual": "4.9.*"
            },
            {
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/ath/ath9k/hif_usb.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-30T13:15:57.377",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/355f16f756aad0c95cdaa0c14a34ab4137d32815",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/53b9bb1a00c4285ee7f58a11129dbea015db61bc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5e8751a977a49a6e00cce1a8da5ca16da83f9c8c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/71fc0ad671a62c494d2aec731baeabd3bfe6c95d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/988bd27de2484faf17afe0408db2e3d9e5ac61fc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/98d9172822dc6f38138333941984bd759a89d419",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dd95f2239fc846795fc926787c3ae0ca701c9840",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f127c2b4c967025e5c3a4ce7e13b79135d46a33d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()\n\nIt is possible that skb is freed in ath9k_htc_rx_msg(), then\nusb_submit_urb() fails and we try to free skb again. It causes\nuse-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes\nNULL but rx_buf is not freed and there can be a memory leak.\n\nThe patch removes unnecessary nskb and makes skb processing more clear: it\nis supposed that ath9k_htc_rx_msg() either frees old skb or passes its\nmanaging to another callback function.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
    }
  ],
  "lastModified": "2026-06-17T05:24:15.630",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}