wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that usb_get_urb() is called but usb_free_urb() (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or urb->ep fields have not been initialized and usb_kill_urb() returns immediately. The patch removes trying to kill urbs located in hif_dev->tx.tx_buf because hif_dev->tx.tx_buf is not supposed to contain urbs which are in pending state (the pending urbs are stored in hif_dev->tx.tx_pending). The tx.tx_lock is acquired so there should not be any changes in the list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Timeline

1. Dec 24, 2025, 1:05 PM UTCCVE published
2. May 23, 2026, 3:25 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 4.9.241 · fixed in 4.9.337; From 4.14.203 · fixed in 4.14.303; From 4.19.154 · fixed in 4.19.270; From 5.4.73 · fixed in 5.4.229; From 4.4.241 · fixed in 4.5; From 5.8.17 · fixed in 5.9; From 5.9.2 · fixed in 5.10

• Linux Linux

  5.10

References 9