In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.

The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00047.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
3deff76095c4ac4252e27c537db3041f619c23a2 affected < 5e8751a977a49a6e00cce1a8da5ca16da83f9c8c
3deff76095c4ac4252e27c537db3041f619c23a2 affected < f127c2b4c967025e5c3a4ce7e13b79135d46a33d
3deff76095c4ac4252e27c537db3041f619c23a2 affected < 0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f
3deff76095c4ac4252e27c537db3041f619c23a2 affected < 988bd27de2484faf17afe0408db2e3d9e5ac61fc
3deff76095c4ac4252e27c537db3041f619c23a2 affected < 98d9172822dc6f38138333941984bd759a89d419
3deff76095c4ac4252e27c537db3041f619c23a2 affected < 355f16f756aad0c95cdaa0c14a34ab4137d32815
3deff76095c4ac4252e27c537db3041f619c23a2 affected < 53b9bb1a00c4285ee7f58a11129dbea015db61bc
3deff76095c4ac4252e27c537db3041f619c23a2 affected < 71fc0ad671a62c494d2aec731baeabd3bfe6c95d
3deff76095c4ac4252e27c537db3041f619c23a2 affected < dd95f2239fc846795fc926787c3ae0ca701c9840
Linux Linux affected
Version Status Constraints
3.0 affected —
0 unaffected < 3.0
4.9.337 unaffected ≤ 4.9.*
4.14.303 unaffected ≤ 4.14.*
4.19.270 unaffected ≤ 4.19.*
5.4.229 unaffected ≤ 5.4.*
5.10.163 unaffected ≤ 5.10.*
5.15.86 unaffected ≤ 5.15.*
6.0.16 unaffected ≤ 6.0.*
6.1.2 unaffected ≤ 6.1.*
6.2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0c8dd2ea4b419da96ab4953e4967e9363e2f8a4f cve-icon cve-icon
https://git.kernel.org/stable/c/355f16f756aad0c95cdaa0c14a34ab4137d32815 cve-icon cve-icon
https://git.kernel.org/stable/c/53b9bb1a00c4285ee7f58a11129dbea015db61bc cve-icon cve-icon
https://git.kernel.org/stable/c/5e8751a977a49a6e00cce1a8da5ca16da83f9c8c cve-icon cve-icon
https://git.kernel.org/stable/c/71fc0ad671a62c494d2aec731baeabd3bfe6c95d cve-icon cve-icon
https://git.kernel.org/stable/c/988bd27de2484faf17afe0408db2e3d9e5ac61fc cve-icon cve-icon
https://git.kernel.org/stable/c/98d9172822dc6f38138333941984bd759a89d419 cve-icon cve-icon
https://git.kernel.org/stable/c/dd95f2239fc846795fc926787c3ae0ca701c9840 cve-icon cve-icon
https://git.kernel.org/stable/c/f127c2b4c967025e5c3a4ce7e13b79135d46a33d cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025123015-CVE-2022-50829-2142@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50829 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50829 cve-icon
History

Wed, 31 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 30 Dec 2025 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Title wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-30T12:10:51.434Z

Reserved: 2025-12-30T12:06:07.132Z

Link: CVE-2022-50829

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-30T13:15:57.377

Modified: 2025-12-31T20:43:05.160

Link: CVE-2022-50829

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-30T00:00:00Z

Links: CVE-2022-50829 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.