CVE-2022-50881: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50881 is a use-after-free vulnerability in the Linux kernel's ath9k Wi-Fi driver, specifically within the ath9k_hif_usb_disconnect() function. The flaw occurs when ath9k_destroy_wmi() attempts to access the drv_priv pointer after it has already been freed by ieee80211_free_hw(), called from ath9k_htc_hw_deinit(). The vulnerability affects the Linux kernel and was published on December 30, 2025. It carries an estimated CVSS severity of Medium (Feedly, CVE.org).

The root cause is a use-after-free condition (CWE-416) in the ath9k HTC USB driver's disconnect path. When a USB device is disconnected, ath9k_htc_hw_deinit() calls ieee80211_free_hw(), which frees the hardware private data (drv_priv). Subsequently, ath9k_destroy_wmi() is called and attempts to read from the already-freed drv_priv memory region. The fix reorders the teardown sequence so that ath9k_destroy_wmi() is called before ieee80211_free_hw(), and ensures that USB URBs are killed before freeing the WMI structure, since URB callbacks also access wmi. The bug was discovered using a modified version of syzkaller and confirmed via KASAN reporting a read of size 8 at a freed address (Feedly, CVEProject GitHub).

Successful exploitation of this vulnerability could allow a local attacker or a process with the ability to trigger USB device disconnection events to cause kernel memory corruption via a use-after-free read. This may result in a kernel crash (denial of service) or, in more sophisticated scenarios, potential information disclosure from freed kernel memory. The impact is limited to systems using ath9k-based USB Wi-Fi adapters (Feedly).

The fix has been applied to the Linux kernel stable trees via multiple commits (e.g., 1f137c6, 99ff971b, 634a547, de15e8b, f099c5c9) that reorder the teardown sequence in ath9k_hif_usb_disconnect(). Users should update to a patched Linux kernel version that includes these fixes. Distributions such as Red Hat have tracked this issue and are expected to provide updated kernel packages. As a workaround, avoiding the use of ath9k-based USB Wi-Fi adapters on sensitive systems reduces exposure (Feedly, CVEProject GitHub).