CVE-2022-50179
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2022
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; */ ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed <IRQ> ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| fb9987d0f748c983bb795a86f47522313f701a08 | affected | git | 62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e | Unavailable | None listed |
| fb9987d0f748c983bb795a86f47522313f701a08 | affected | git | ab7a0ddf5f1cdec63cb21840369873806fc36d80 | Unavailable | None listed |
| fb9987d0f748c983bb795a86f47522313f701a08 | affected | git | e9e21206b8ea62220b486310c61277e7ebfe7cec | Unavailable | None listed |
| fb9987d0f748c983bb795a86f47522313f701a08 | affected | git | eccd7c3e2596b574241a7670b5b53f5322f470e5 | Unavailable | None listed |
| fb9987d0f748c983bb795a86f47522313f701a08 | affected | git | 03ca957c5f7b55660957eda20b5db4110319ac7a | Unavailable | None listed |
| fb9987d0f748c983bb795a86f47522313f701a08 | affected | git | 6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6 | Unavailable | None listed |
| fb9987d0f748c983bb795a86f47522313f701a08 | affected | git | b66ebac40f64336ae2d053883bee85261060bd27 | Unavailable | None listed |
| fb9987d0f748c983bb795a86f47522313f701a08 | affected | git | 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.6.35 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 2.6.35 | Unavailable | None listed |
| 4.14.291 | unaffected | semver | Unavailable | 4.14.* | None listed |
| 4.19.256 | unaffected | semver | Unavailable | 4.19.* | None listed |
| 5.4.211 | unaffected | semver | Unavailable | 5.4.* | None listed |
| 5.10.137 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.61 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 5.18.18 | unaffected | semver | Unavailable | 5.18.* | None listed |
| 5.19.2 | unaffected | semver | Unavailable | 5.19.* | None listed |
| 6.0 | unaffected | original_commit_for_fix | Unavailable | * | None listed |