{"id":"CVE-2022-50740","state":"PUBLISHED","title":"wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()\n\nSyzkaller reports a long-known leak of urbs in\nath9k_hif_usb_dealloc_tx_urbs().\n\nThe cause of the leak is that usb_get_urb() is called but usb_free_urb()\n(or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or\nurb->ep fields have not been initialized and usb_kill_urb() returns\nimmediately.\n\nThe patch removes trying to kill urbs located in hif_dev->tx.tx_buf\nbecause hif_dev->tx.tx_buf is not supposed to contain urbs which are in\npending state (the pending urbs are stored in hif_dev->tx.tx_pending).\nThe tx.tx_lock is acquired so there should not be any changes in the list.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.","publishedAt":"2025-12-24T13:05:38.150Z","updatedAt":"2026-05-23T15:25:05.028Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6f0706ef39fecc6bf56d67728fe0c94e26b43e9d","status":"affected","lessThan":"134ae5eba41294eff76e4be20d6001b8f0192207","versionType":"git"},{"version":"795d57a558d106b8a5bc2bd7aeaf707d9a099244","status":"affected","lessThan":"472312fef2b9eccaa03bd59e0ab2527da945e736","versionType":"git"},{"version":"df4318440c1568b7dedc5f7d4e617d0e297a1313","status":"affected","lessThan":"eddbb8f7620f9f8008b090a6e10c460074ca575a","versionType":"git"},{"version":"a9990ed2d7ca9339d37c7f67d6f5cb298c3f1b34","status":"affected","lessThan":"9850791d389b342ae6e573fe8198db0b4d338352","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"d856f7574bcc1d81de565a857caf32f122cd7ce0","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"c05189a429fdb371dd455c3c466d67ac2ebff152","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"08aa0537ec8cf29ceccae98acc1a534fc12598c1","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"c2a94de38c74e86f49124ac14f093d6a5c377a90","versionType":"git"},{"version":"b92e116ae36f498858dbb18e29a066c3f5348965","status":"affected","versionType":"git"},{"version":"7f5972267295fe49f8da8eb42bc2eb3d140860c0","status":"affected","versionType":"git"},{"version":"2d72d5ce63c92f56b9f978e8befb5838144176b9","status":"affected","versionType":"git"},{"version":"4.9.241","status":"affected","lessThan":"4.9.337","versionType":"semver"},{"version":"4.14.203","status":"affected","lessThan":"4.14.303","versionType":"semver"},{"version":"4.19.154","status":"affected","lessThan":"4.19.270","versionType":"semver"},{"version":"5.4.73","status":"affected","lessThan":"5.4.229","versionType":"semver"},{"version":"4.4.241","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"5.8.17","status":"affected","lessThan":"5.9","versionType":"semver"},{"version":"5.9.2","status":"affected","lessThan":"5.10","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath9k/hif_usb.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"4.9.337","status":"unaffected","lessThanOrEqual":"4.9.*","versionType":"semver"},{"version":"4.14.303","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.270","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.229","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.163","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.86","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.16","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.2","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath9k/hif_usb.c"]}],"references":["https://git.kernel.org/stable/c/134ae5eba41294eff76e4be20d6001b8f0192207","https://git.kernel.org/stable/c/472312fef2b9eccaa03bd59e0ab2527da945e736","https://git.kernel.org/stable/c/eddbb8f7620f9f8008b090a6e10c460074ca575a","https://git.kernel.org/stable/c/9850791d389b342ae6e573fe8198db0b4d338352","https://git.kernel.org/stable/c/c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d","https://git.kernel.org/stable/c/d856f7574bcc1d81de565a857caf32f122cd7ce0","https://git.kernel.org/stable/c/c05189a429fdb371dd455c3c466d67ac2ebff152","https://git.kernel.org/stable/c/08aa0537ec8cf29ceccae98acc1a534fc12598c1","https://git.kernel.org/stable/c/c2a94de38c74e86f49124ac14f093d6a5c377a90"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50740.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50740","state":"PUBLISHED","datePublished":"2025-12-24T13:05:38.150Z","dateUpdated":"2026-05-23T15:25:05.028Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-24T13:02:21.542Z"},"containers":{"cna":{"title":"wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()\n\nSyzkaller reports a long-known leak of urbs in\nath9k_hif_usb_dealloc_tx_urbs().\n\nThe cause of the leak is that usb_get_urb() is called but usb_free_urb()\n(or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or\nurb->ep fields have not been initialized and usb_kill_urb() returns\nimmediately.\n\nThe patch removes trying to kill urbs located in hif_dev->tx.tx_buf\nbecause hif_dev->tx.tx_buf is not supposed to contain urbs which are in\npending state (the pending urbs are stored in hif_dev->tx.tx_pending).\nThe tx.tx_lock is acquired so there should not be any changes in the list.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6f0706ef39fecc6bf56d67728fe0c94e26b43e9d","status":"affected","lessThan":"134ae5eba41294eff76e4be20d6001b8f0192207","versionType":"git"},{"version":"795d57a558d106b8a5bc2bd7aeaf707d9a099244","status":"affected","lessThan":"472312fef2b9eccaa03bd59e0ab2527da945e736","versionType":"git"},{"version":"df4318440c1568b7dedc5f7d4e617d0e297a1313","status":"affected","lessThan":"eddbb8f7620f9f8008b090a6e10c460074ca575a","versionType":"git"},{"version":"a9990ed2d7ca9339d37c7f67d6f5cb298c3f1b34","status":"affected","lessThan":"9850791d389b342ae6e573fe8198db0b4d338352","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"d856f7574bcc1d81de565a857caf32f122cd7ce0","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"c05189a429fdb371dd455c3c466d67ac2ebff152","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"08aa0537ec8cf29ceccae98acc1a534fc12598c1","versionType":"git"},{"version":"03fb92a432ea5abe5909bca1455b7e44a9380480","status":"affected","lessThan":"c2a94de38c74e86f49124ac14f093d6a5c377a90","versionType":"git"},{"version":"b92e116ae36f498858dbb18e29a066c3f5348965","status":"affected","versionType":"git"},{"version":"7f5972267295fe49f8da8eb42bc2eb3d140860c0","status":"affected","versionType":"git"},{"version":"2d72d5ce63c92f56b9f978e8befb5838144176b9","status":"affected","versionType":"git"},{"version":"4.9.241","status":"affected","lessThan":"4.9.337","versionType":"semver"},{"version":"4.14.203","status":"affected","lessThan":"4.14.303","versionType":"semver"},{"version":"4.19.154","status":"affected","lessThan":"4.19.270","versionType":"semver"},{"version":"5.4.73","status":"affected","lessThan":"5.4.229","versionType":"semver"},{"version":"4.4.241","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"5.8.17","status":"affected","lessThan":"5.9","versionType":"semver"},{"version":"5.9.2","status":"affected","lessThan":"5.10","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath9k/hif_usb.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.10","versionType":"semver"},{"version":"4.9.337","status":"unaffected","lessThanOrEqual":"4.9.*","versionType":"semver"},{"version":"4.14.303","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.270","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.229","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.163","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.86","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.16","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.2","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ath/ath9k/hif_usb.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/134ae5eba41294eff76e4be20d6001b8f0192207"},{"url":"https://git.kernel.org/stable/c/472312fef2b9eccaa03bd59e0ab2527da945e736"},{"url":"https://git.kernel.org/stable/c/eddbb8f7620f9f8008b090a6e10c460074ca575a"},{"url":"https://git.kernel.org/stable/c/9850791d389b342ae6e573fe8198db0b4d338352"},{"url":"https://git.kernel.org/stable/c/c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d"},{"url":"https://git.kernel.org/stable/c/d856f7574bcc1d81de565a857caf32f122cd7ce0"},{"url":"https://git.kernel.org/stable/c/c05189a429fdb371dd455c3c466d67ac2ebff152"},{"url":"https://git.kernel.org/stable/c/08aa0537ec8cf29ceccae98acc1a534fc12598c1"},{"url":"https://git.kernel.org/stable/c/c2a94de38c74e86f49124ac14f093d6a5c377a90"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-23T15:25:05.028Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.241","versionEndExcluding":"4.9.337"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.203","versionEndExcluding":"4.14.303"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.154","versionEndExcluding":"4.19.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.73","versionEndExcluding":"5.4.229"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.10.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.0.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.241"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}