In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; */ ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed <IRQ> ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/03ca957c5f7b55660957eda20b5db4110319ac7a cve-icon cve-icon
https://git.kernel.org/stable/c/0ac4827f78c7ffe8eef074bc010e7e34bc22f533 cve-icon cve-icon
https://git.kernel.org/stable/c/62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e cve-icon cve-icon
https://git.kernel.org/stable/c/6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6 cve-icon cve-icon
https://git.kernel.org/stable/c/ab7a0ddf5f1cdec63cb21840369873806fc36d80 cve-icon cve-icon
https://git.kernel.org/stable/c/b66ebac40f64336ae2d053883bee85261060bd27 cve-icon cve-icon
https://git.kernel.org/stable/c/e9e21206b8ea62220b486310c61277e7ebfe7cec cve-icon cve-icon
https://git.kernel.org/stable/c/eccd7c3e2596b574241a7670b5b53f5322f470e5 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025061832-CVE-2022-50179-92c5@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50179 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50179 cve-icon
History

Fri, 20 Jun 2025 14:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Wed, 18 Jun 2025 11:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv = priv; */ ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed <IRQ> ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]
Title ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-06-18T11:03:28.841Z

Reserved: 2025-06-18T10:57:27.427Z

Link: CVE-2022-50179

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-06-18T11:15:48.330

Modified: 2025-06-18T13:47:40.833

Link: CVE-2022-50179

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-06-18T00:00:00Z

Links: CVE-2022-50179 - Bugzilla