CVE-2022-50179 - Vulnerability Details

- ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

Description

In the Linux kernel, the following vulnerability has been resolved:

ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
problem was in incorrect htc_handle->drv_priv initialization.

Probable call trace which can trigger use-after-free:

ath9k_htc_probe_device()
/* htc_handle->drv_priv = priv; */
ath9k_htc_wait_for_target() <--- Failed
ieee80211_free_hw() <--- priv pointer is freed

<IRQ>
...
ath9k_hif_usb_rx_cb()
ath9k_hif_usb_rx_stream()
RX_STAT_INC() <--- htc_handle->drv_priv access

In order to not add fancy protection for drv_priv we can move
htc_handle->drv_priv initialization at the end of the
ath9k_htc_probe_device() and add helper macro to make
all *_STAT_* macros NULL safe, since syzbot has reported related NULL
deref in that macros [1]

Published: 2025-06-18

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fb9987d0f748c983bb795a86f47522313f701a08`	affected	< 62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e
`fb9987d0f748c983bb795a86f47522313f701a08`	affected	< ab7a0ddf5f1cdec63cb21840369873806fc36d80
`fb9987d0f748c983bb795a86f47522313f701a08`	affected	< e9e21206b8ea62220b486310c61277e7ebfe7cec
`fb9987d0f748c983bb795a86f47522313f701a08`	affected	< eccd7c3e2596b574241a7670b5b53f5322f470e5
`fb9987d0f748c983bb795a86f47522313f701a08`	affected	< 03ca957c5f7b55660957eda20b5db4110319ac7a
`fb9987d0f748c983bb795a86f47522313f701a08`	affected	< 6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6
`fb9987d0f748c983bb795a86f47522313f701a08`	affected	< b66ebac40f64336ae2d053883bee85261060bd27
`fb9987d0f748c983bb795a86f47522313f701a08`	affected	< 0ac4827f78c7ffe8eef074bc010e7e34bc22f533

Linux

affected

Version	Status	Constraints
`2.6.35`	affected	—
`0`	unaffected	< 2.6.35
`4.14.291`	unaffected	≤ 4.14.*
`4.19.256`	unaffected	≤ 4.19.*
`5.4.211`	unaffected	≤ 5.4.*
`5.10.137`	unaffected	≤ 5.10.*
`5.15.61`	unaffected	≤ 5.15.*
`5.18.18`	unaffected	≤ 5.18.*
`5.19.2`	unaffected	≤ 5.19.*
`6.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor	Product	Confidence	Versions
Linux	Linux Kernel	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-55444	In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; / ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed <IRQ> ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all _STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00064.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03ca957c5f7b55660957eda20b5db4110319ac7a
https://git.kernel.org/stable/c/0ac4827f78c7ffe8eef074bc010e7e34bc22f533
https://git.kernel.org/stable/c/62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e
https://git.kernel.org/stable/c/6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6
https://git.kernel.org/stable/c/ab7a0ddf5f1cdec63cb21840369873806fc36d80
https://git.kernel.org/stable/c/b66ebac40f64336ae2d053883bee85261060bd27
https://git.kernel.org/stable/c/e9e21206b8ea62220b486310c61277e7ebfe7cec
https://git.kernel.org/stable/c/eccd7c3e2596b574241a7670b5b53f5322f470e5
https://lore.kernel.org/linux-cve-announce/2025061832-CVE-2022-50179-92c5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-50179
https://www.cve.org/CVERecord?id=CVE-2022-50179

History

Thu, 20 Nov 2025 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 20 Jun 2025 14:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025061832-CVE-2022-50179-92c5@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2022-50179 https://www.cve.org/CVERecord?id=CVE-2022-50179
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 18 Jun 2025 11:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; / ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed <IRQ> ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all _STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]
Title		ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
References		https://git.kernel.org/stable/c/03ca957c5f7b55660957eda20b5db4110319ac7a https://git.kernel.org/stable/c/0ac4827f78c7ffe8eef074bc010e7e34bc22f533 https://git.kernel.org/stable/c/62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e https://git.kernel.org/stable/c/6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6 https://git.kernel.org/stable/c/ab7a0ddf5f1cdec63cb21840369873806fc36d80 https://git.kernel.org/stable/c/b66ebac40f64336ae2d053883bee85261060bd27 https://git.kernel.org/stable/c/e9e21206b8ea62220b486310c61277e7ebfe7cec https://git.kernel.org/stable/c/eccd7c3e2596b574241a7670b5b53f5322f470e5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-06-18T11:03:28.841Z

Updated: 2026-05-11T19:14:20.518Z

Reserved: 2025-06-18T10:57:27.427Z

Link: CVE-2022-50179

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2025-06-18T11:15:48.330

Modified: 2025-11-20T22:02:06.180

Link: CVE-2022-50179

Redhat

Severity : Moderate

Publid Date: 2025-06-18T00:00:00Z

Links: CVE-2022-50179 - Bugzilla

OpenCVE Enrichment

Updated: 2025-06-23T08:45:30Z

Weaknesses

CWE-416

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object