CVE-2022-50881: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50881 is a use-after-free vulnerability in the Linux kernel's ath9k Wi-Fi driver, specifically within the ath9k_hif_usb_disconnect() function. The flaw occurs when ath9k_destroy_wmi() attempts to access the drv_priv pointer after it has already been freed by ieee80211_free_hw(), called from ath9k_htc_hw_deinit(). The vulnerability affects the Linux kernel and was published on December 30, 2025. It carries an estimated CVSS severity of Medium (Feedly, CVE.org).

The root cause is a use-after-free condition (CWE-416) in the ath9k HTC USB driver's disconnect path. When a USB device is disconnected, ath9k_htc_hw_deinit() calls ieee80211_free_hw(), which frees the hardware private data (drv_priv). Subsequently, ath9k_destroy_wmi() is called and attempts to read from the already-freed drv_priv memory region. The fix reorders the teardown sequence so that ath9k_destroy_wmi() is called before ieee80211_free_hw(), and ensures that USB URBs are killed before freeing the WMI structure, since URB callbacks also access wmi. The bug was discovered using a modified version of syzkaller and confirmed via KASAN reporting a read of size 8 at a freed address (Feedly, CVEProject GitHub).

Successful exploitation of this vulnerability could allow a local attacker or a process with the ability to trigger USB device disconnection events to cause kernel memory corruption via a use-after-free read. This may result in a kernel crash (denial of service) or, in more sophisticated scenarios, potential information disclosure from freed kernel memory. The impact is limited to systems using ath9k-based USB Wi-Fi adapters (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2022-50881. The EPSS score is very low at approximately 0.018%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access or the ability to physically connect/disconnect a USB Wi-Fi device using the ath9k driver (Feedly).

The fix has been applied to the Linux kernel stable trees via multiple commits (e.g., 1f137c6, 99ff971b, 634a547, de15e8b, f099c5c9) that reorder the teardown sequence in ath9k_hif_usb_disconnect(). Users should update to a patched Linux kernel version that includes these fixes. Distributions such as Red Hat have tracked this issue and are expected to provide updated kernel packages. As a workaround, avoiding the use of ath9k-based USB Wi-Fi adapters on sensitive systems reduces exposure (Feedly, CVEProject GitHub).