CVE-2022-50740 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs().
The cause of the leak is that usb_get_urb() is called but usb_free_urb() (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or urb->ep fields have not been initialized and usb_kill_urb() returns immediately.
The patch removes trying to kill urbs located in hif_dev->tx.tx_buf because hif_dev->tx.tx_buf is not supposed to contain urbs which are in pending state (the pending urbs are stored in hif_dev->tx.tx_pending). The tx.tx_lock is acquired so there should not be any changes in the list.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability CVE-2022-50740 represents a memory leak issue within the Linux kernel's wireless networking subsystem, specifically affecting the ath9k driver's USB host interface implementation. This flaw exists in the ath9k_hif_usb_dealloc_tx_urbs() function where the kernel fails to properly release USB request blocks (URBs) that are allocated for wireless transmission operations. The issue was identified through systematic kernel testing conducted by the Linux Verification Center using the Syzkaller fuzzer, which is a powerful automated testing tool designed to discover kernel-level vulnerabilities through random system call invocation and memory manipulation.
The technical root cause of this memory leak stems from improper URB management within the USB communication layer of the ath9k wireless driver. When the usb_get_urb() function is invoked to allocate USB request blocks, the corresponding usb_free_urb() or usb_put_urb() cleanup functions are not properly called within the usb_kill_urb() context. This occurs because the urb->dev and urb->ep fields remain uninitialized, causing usb_kill_urb() to return immediately without performing the necessary cleanup operations. The flaw demonstrates a classic memory management error where allocated resources are not properly deallocated, leading to gradual memory consumption that can eventually impact system stability and performance.
The operational impact of this vulnerability extends beyond simple memory waste, as it represents a potential denial-of-service vector that could degrade wireless networking performance over time. The affected code path processes transmission URBs in the ath9k_hif_usb_dealloc_tx_urbs() function where the driver attempts to clean up URBs that are no longer needed. However, due to the improper handling of the tx.tx_buf list which contains URBs not in pending state, the cleanup operation fails to properly release these resources. This memory leak is particularly concerning in embedded systems or devices with limited memory resources where continuous resource exhaustion could lead to system instability or complete wireless functionality failure.
The fix for CVE-2022-50740 addresses the core issue by removing the attempt to kill URBs from the hif_dev->tx.tx_buf list, recognizing that this buffer should not contain URBs in pending state since those are properly managed in hif_dev->tx.tx_pending. The solution involves acquiring the tx.tx_lock to ensure thread safety during list modifications and preventing the erroneous cleanup of URBs that are not actually pending. This approach aligns with the CWE-401 standard for improper release of memory, which specifically addresses memory leaks caused by failure to properly deallocate allocated resources. The vulnerability also maps to ATT&CK technique T1489 which covers testing for resource exhaustion attacks, as the memory leak could be exploited to consume system resources over time. The patch effectively resolves the memory management inconsistency by ensuring that only properly pending URBs are subjected to cleanup operations, thereby preventing the accumulation of unreleased memory blocks that could eventually impact system performance and reliability.