CVE-2022-50829: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50829 is a use-after-free vulnerability in the Linux kernel's ath9k Wi-Fi driver, specifically within the ath9k_hif_usb_reg_in_cb() function of the HIF USB subsystem. The flaw allows a socket buffer (skb) to be freed inside ath9k_htc_rx_msg(), after which a failed usb_submit_urb() call attempts to free the same skb again, triggering a use-after-free condition. An additional memory leak can occur if alloc_skb() fails, leaving rx_buf unreleased while urb->context becomes NULL. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using Syzkaller and published on December 30, 2025. It carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.033% (Feedly).

The root cause is a use-after-free memory management error (CWE-416) in the ath9k HIF USB driver's receive callback path. When ath9k_htc_rx_msg() processes an incoming USB packet, it may free the skb buffer; if the subsequent usb_submit_urb() call fails, the error-handling code incorrectly attempts to free the already-released skb a second time. A secondary issue exists where a failed alloc_skb() allocation sets urb->context to NULL without releasing rx_buf, resulting in a memory leak. The fix restructures skb lifecycle management so that ath9k_htc_rx_msg() is solely responsible for either freeing the buffer or transferring ownership to another callback, eliminating the double-free scenario (Feedly, Kernel Patch).

Exploitation of this vulnerability could lead to kernel memory corruption due to the use-after-free condition, potentially resulting in a system crash (denial of service) or, in more severe scenarios, privilege escalation if an attacker can control the freed memory region. The secondary memory leak may gradually degrade system stability on affected devices using ath9k USB Wi-Fi adapters. The vulnerability is confined to systems with ath9k HIF USB hardware attached and running an unpatched Linux kernel version (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update their Linux kernel to one of these patched versions or later. No configuration-based workaround is available; the recommended action is to apply the relevant stable kernel update for your distribution (Feedly, Kernel Patch).