CVE-2022-50740: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50740 is a memory leak vulnerability in the Linux kernel's ath9k WiFi driver USB implementation, specifically in the ath9k_hif_usb_dealloc_tx_urbs() function. The flaw was discovered by the Linux Verification Center (linuxtesting.org) using Syzkaller and publicly disclosed on December 24, 2025. It affects multiple Linux kernel versions prior to the patched releases (4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2). The CVSS v3.1 base score is 7.0 (High), requiring local access with low privileges and high attack complexity (Red Hat CVE, Feedly).

The root cause is a missing resource release (CWE-401: Missing Release of Memory after Effective Lifetime) in the ath9k_hif_usb_dealloc_tx_urbs() function. When usb_get_urb() is called to increment the reference count of a USB Request Block (URB), the corresponding usb_free_urb() or usb_put_urb() is never called because usb_kill_urb() returns immediately — the urb->dev and urb->ep fields are uninitialized at that point. The fix removes the erroneous attempt to kill URBs stored in hif_dev->tx.tx_buf, since that list is not intended to hold pending URBs (those are tracked in hif_dev->tx.tx_pending), and acquires tx.tx_lock to prevent concurrent list modifications (Red Hat CVE, ENISA EUVD).

Successful exploitation by a low-privileged local attacker can cause gradual memory exhaustion in the kernel's WiFi USB driver subsystem. Over time, this leads to system performance degradation, increased instability, and potential denial-of-service conditions — particularly on long-running systems with ath9k USB WiFi adapters attached. Confidentiality and integrity impacts are rated High in the CVSS scoring, though the primary practical risk is availability loss through memory exhaustion (Red Hat CVE, Feedly).

The primary remediation is to update to a patched Linux kernel version: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2 and later. For systems that cannot be immediately patched, administrators should monitor kernel memory usage for unexplained growth, limit physical or logical access to USB WiFi devices using the ath9k driver, and consider periodic reboots to clear accumulated leaked memory. As a last resort on critical systems, the ath9k_htc kernel module can be blacklisted to prevent the driver from loading (Red Hat CVE, Feedly).