Detection-and-Mitigation-for-CVE-2022-1679

针对 CVE-2022-1679 的检测与缓解 ath9k 是一个支持 Atheros 芯片的 Linux 内核驱动程序。在 Linux 内核的 Atheros 无线适配器驱动中发现了一个释放后使用漏洞，其利用方式为用户通过某些输入消息强制 ath9khtcwaitfortarget 函数失败。此漏洞允许本地用户使系统崩溃或可能提升其权限。建议在未使用受影响版本的 CVE-2022-1679 漏洞模块时将其加入黑名单。 安装 wget...

kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash

A flaw was found in the ath9k Wi-Fi driver in the Linux kernel. A race condition exists during the asynchronous firmware loading process and device disconnection. A local attacker, by repeatedly connecting and disconnecting a malicious USB Wi-Fi device that fails firmware download, could trigger ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: A range check was added for connrspepid in htcconnectservice. I have also identified the following bugs in my fuzzer: - UBSAN: Array index out of bounds in drivers/net/wireless/ath/ath9k/htchst.c:26:51. Index 255 is...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: Fixed a potential stack-out-of-bounds write in ath9kwmirspcallback. This bug involves writing to wmi-cmdrspbuf, a stack-allocated buffer that may become invalid when a timeout occurs. Set wmi-lastseqid to 0 when a...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: hifusb: A use-after-free issue has been fixed in ath9khifusbregincb. It is possible that the skb buffer is freed during ath9khtcrxmsg, and then usbsubmiturb fails. As a result, we try to free the skb buffer again,...

UBUNTU-CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

CVE-2026-74408 wifi: ath9k: fix OOB access from firmware tx status queue ID

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013149)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013149 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9kwmictrlrx For the reasons also described in...

The vulnerability of the ath9k_hif_usb_alloc_tx_urbs() function in the drivers/net/wireless/ath/ath9k/hif_usb.c module of the Atheros/Qualcomm wireless adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ath9khifusballoctxurbs function in the drivers/net/wireless/ath/ath9k/hifusb.c module of the Atheros/Qualcomm wireless adapter driver in the Linux operating system is related to incorrect initialization of resources. Exploiting this vulnerability could allow an attacker t...

The vulnerability in the function ath9k_htc_probe_device() of the drivers/net/wireless/ath/ath9k/htc_drv_init.c file, a driver for Atheros/Qualcomm wireless adapter devices in the Linux operating system, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ath9khtcprobedevice function in the drivers/net/wireless/ath/ath9k/htcdrvinit.c file of the Atheros/Qualcomm wireless adapter driver for the Linux operating system is related to the reutilization of previously freed memory due to incorrect initialization. Exploiting this...

The vulnerability of the ath9k_hif_usb_rx_stream() function in the drivers/net/wireless/ath/ath9k/hif_usb.c file of the Atheros/Qualcomm wireless communication adapter driver for the Linux operating system allows a malicious actor to cause a service failure remotely.

The vulnerability of the ath9khifusbrxstream function in the drivers/net/wireless/ath/ath9k/hifusb.c module of the Atheros/Qualcomm wireless communication adapter driver in the Linux operating system is related to the failure to release resources after their useful life has ended. Exploiting this...

The vulnerability of the ath9k_hif_usb_reg_in_cb() function in the drivers/net/wireless/ath/ath9k/hif_usb.c driver module of the Atheros/Qualcomm wireless communication adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ath9khifusbregincb function in the drivers/net/wireless/ath/ath9k/hifusb.c driver for Atheros/Qualcomm wireless communication adapters in the Linux operating system is related to the use of memory after deallocation. Exploiting this vulnerability could allow an attacker t...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003992)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003992 advisory. Memory leaks in drivers/net/wireless/ath/ath9k/htchst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service memory consumption by...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992985)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992985 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: verify the expected usbendpoints are present The bug arises when a USB device claims...

CVE-2023-54300

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9kwmictrlrx For the reasons also described in commit b383e8abed41 "wifi: ath9k: avoid uninit memory read in ath9khtcrxmsg", ath9khtcrxmsg should validate pktlen before accessing...

CVE-2023-54300 wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9kwmictrlrx For the reasons also described in commit b383e8abed41 "wifi: ath9k: avoid uninit memory read in ath9khtcrxmsg", ath9khtcrxmsg should validate pktlen before accessing...

CVE-2022-50709 wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read in ath9khtcrxmsg syzbot is reporting uninit value at ath9khtcrxmsg 1, for ioctlUSBRAWIOCTLEPWRITE can call ath9khifusbrxstream with pktlen = 0 but ath9khifusbrxstream uses devallocskbpktlen +...

PT-2025-53106

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak in the ath9k High-Speed USB HIF USB driver, specifically within the ath9k hif usb dealloc tx urbs function. The issue stems from a failure to...

DEBIAN-CVE-2023-53802

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: htchst: free skb in ath9khtcrxmsg if there is no callback function It is stated that ath9khtcrxmsg either frees the provided skb or passes its management to another callback function. However, the skb is not freed in...

kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved for HTCCTRLRSVDSVC and should not be...