---
id: CVE-2022-50186
title: 'ath11k: fix missing skb drop on htc_tx_completion error'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ath11k: fix missing skb drop on htc_tx_completion error

  On htc_tx_completion error the skb is not dropped. This is wrong since
  the completion_handler logic expect the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f951380a6022440335f668f85296096ba13071ba <
    dda25326839d6e6b1fe59e79616149e44ea4eaa4
  - >-
    Linux >= f951380a6022440335f668f85296096ba13071ba <
    1f1483361585ae7556492f50f83f038bbdf8c294
  - >-
    Linux >= f951380a6022440335f668f85296096ba13071ba <
    e5646fe3b7ef739c392e59da7db6adf5e1fdef42
  - Linux 5.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:06:35.864496Z'
published: '2025-06-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:10:28.190Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50186'
references:
  - url: 'https://git.kernel.org/stable/c/dda25326839d6e6b1fe59e79616149e44ea4eaa4'
  - url: 'https://git.kernel.org/stable/c/1f1483361585ae7556492f50f83f038bbdf8c294'
  - url: 'https://git.kernel.org/stable/c/e5646fe3b7ef739c392e59da7db6adf5e1fdef42'
tags:
  - cve.org
epss: 0.00249
epssPercentile: 0.16368
ingestedAt: '2026-11-05T22:38:31.700Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ath11k: fix missing skb drop on htc_tx_completion error

On htc_tx_completion error the skb is not dropped. This is wrong since
the completion_handler logic expect the skb to be consumed anyway even
when an error is triggered. Not freeing the skb on error is a memory
leak since the skb won't be freed anywere else. Correctly free the
packet on eid >= ATH11K_HTC_EP_COUNT before returning.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1

## Affected

- `Linux >= f951380a6022440335f668f85296096ba13071ba < dda25326839d6e6b1fe59e79616149e44ea4eaa4`
- `Linux >= f951380a6022440335f668f85296096ba13071ba < 1f1483361585ae7556492f50f83f038bbdf8c294`
- `Linux >= f951380a6022440335f668f85296096ba13071ba < e5646fe3b7ef739c392e59da7db6adf5e1fdef42`
- `Linux 5.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.