---
id: CVE-2022-50179
title: 'ath9k: fix use-after-free in ath9k_hif_usb_rx_cb'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

  Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
  problem was in incorrect htc_handle->drv_priv in…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    ab7a0ddf5f1cdec63cb21840369873806fc36d80
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    e9e21206b8ea62220b486310c61277e7ebfe7cec
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    eccd7c3e2596b574241a7670b5b53f5322f470e5
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    03ca957c5f7b55660957eda20b5db4110319ac7a
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    b66ebac40f64336ae2d053883bee85261060bd27
  - >-
    Linux >= fb9987d0f748c983bb795a86f47522313f701a08 <
    0ac4827f78c7ffe8eef074bc010e7e34bc22f533
  - Linux 2.6.35
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:06:30.724217Z'
published: '2025-06-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:10:27.991Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50179'
references:
  - url: 'https://git.kernel.org/stable/c/62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e'
  - url: 'https://git.kernel.org/stable/c/ab7a0ddf5f1cdec63cb21840369873806fc36d80'
  - url: 'https://git.kernel.org/stable/c/e9e21206b8ea62220b486310c61277e7ebfe7cec'
  - url: 'https://git.kernel.org/stable/c/eccd7c3e2596b574241a7670b5b53f5322f470e5'
  - url: 'https://git.kernel.org/stable/c/03ca957c5f7b55660957eda20b5db4110319ac7a'
  - url: 'https://git.kernel.org/stable/c/6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6'
  - url: 'https://git.kernel.org/stable/c/b66ebac40f64336ae2d053883bee85261060bd27'
  - url: 'https://git.kernel.org/stable/c/0ac4827f78c7ffe8eef074bc010e7e34bc22f533'
tags:
  - cve.org
epss: 0.0026
epssPercentile: 0.17742
ingestedAt: '2026-11-05T22:38:31.700Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The
problem was in incorrect htc_handle->drv_priv initialization.

Probable call trace which can trigger use-after-free:

ath9k_htc_probe_device()
  /* htc_handle->drv_priv = priv; */
  ath9k_htc_wait_for_target()      <--- Failed
  ieee80211_free_hw()		   <--- priv pointer is freed

<IRQ>
...
ath9k_hif_usb_rx_cb()
  ath9k_hif_usb_rx_stream()
   RX_STAT_INC()		<--- htc_handle->drv_priv access

In order to not add fancy protection for drv_priv we can move
htc_handle->drv_priv initialization at the end of the
ath9k_htc_probe_device() and add helper macro to make
all *_STAT_* macros NULL safe, since syzbot has reported related NULL
deref in that macros [1]

## Affected

- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 62bc1ea5c7401d77eaf73d0c6a15f3d2e742856e`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < ab7a0ddf5f1cdec63cb21840369873806fc36d80`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < e9e21206b8ea62220b486310c61277e7ebfe7cec`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < eccd7c3e2596b574241a7670b5b53f5322f470e5`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 03ca957c5f7b55660957eda20b5db4110319ac7a`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 6b14ab47937ba441e75e8dbb9fbfc9c55efa41c6`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < b66ebac40f64336ae2d053883bee85261060bd27`
- `Linux >= fb9987d0f748c983bb795a86f47522313f701a08 < 0ac4827f78c7ffe8eef074bc010e7e34bc22f533`
- `Linux 2.6.35`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.