linux-cve-announce - CVE-2022-50186: ath11k: fix missing skb drop on htc_tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061834-CVE-2022-50186-1ecc@gregkh>
Date: Wed, 18 Jun 2025 13:04:11 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50186: ath11k: fix missing skb drop on htc_tx_completion error

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ath11k: fix missing skb drop on htc_tx_completion error

On htc_tx_completion error the skb is not dropped. This is wrong since
the completion_handler logic expect the skb to be consumed anyway even
when an error is triggered. Not freeing the skb on error is a memory
leak since the skb won't be freed anywere else. Correctly free the
packet on eid >= ATH11K_HTC_EP_COUNT before returning.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1

The Linux kernel CVE team has assigned CVE-2022-50186 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit f951380a6022440335f668f85296096ba13071ba and fixed in 5.18.18 with commit dda25326839d6e6b1fe59e79616149e44ea4eaa4
	Issue introduced in 5.17 with commit f951380a6022440335f668f85296096ba13071ba and fixed in 5.19.2 with commit 1f1483361585ae7556492f50f83f038bbdf8c294
	Issue introduced in 5.17 with commit f951380a6022440335f668f85296096ba13071ba and fixed in 6.0 with commit e5646fe3b7ef739c392e59da7db6adf5e1fdef42

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50186
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/ath/ath11k/htc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/dda25326839d6e6b1fe59e79616149e44ea4eaa4
	https://git.kernel.org/stable/c/1f1483361585ae7556492f50f83f038bbdf8c294
	https://git.kernel.org/stable/c/e5646fe3b7ef739c392e59da7db6adf5e1fdef42