Loading story…
A use-after-free flaw in the Linux kernel's ath9k_htc Atheros USB Wi-Fi driver, tracked as CVE-2022-1679, can be triggered by a local low-privileged user using crafted input messages. The bug occurs when driver initialization fails after drv_priv is assigned: hardware-private data may be freed while an asynchronous receive callback still accesses it, causing a kernel crash and potentially exposing memory. The original report also identified a possible privilege-escalation condition.
Red Hat assigned the issue a Moderate severity rating with CVSS 7.0 and released fixes for supported Red Hat Enterprise Linux 8 and 9 kernel variants. Although exploitation for privilege escalation is assessed as unlikely because it depends on difficult race conditions, organizations should deploy updated kernels or prevent the ath9k module from loading where the adapter is not needed. RHEL 6 and 7 kernel packages are outside support scope and should be treated as affected unless mitigated or upgraded.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:2951 and RHSA-2023:2736 to fix CVE-2022-1679 in supported RHEL 8 kernel and kernel-rt packages.
Red Hat issued RHSA-2022:8267 and RHSA-2022:7933, providing fixed RHEL 9 kernel and kernel-rt packages for CVE-2022-1679.
Pavel Skripkin submitted a proposed patch moving drv_priv assignment until successful initialization and making driver statistics macros safe when drv_priv is NULL. Reviewers requested macro cleanup and syzbot-report links for a subsequent revision.
RHSA-2024:0412 provided a CVE-2022-1679 kernel fix for RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 for RHEL 8.
syzbot reported a use-after-free read in the Linux ath9k HTC USB Wi-Fi driver, and Elijahbai of Tencent Security Yunding Lab reported the vulnerability to Red Hat. The failure path can leave drv_priv pointing to freed private data after ath9k_htc_wait_for_target() fails.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-57995** is a moderate-severity use-after-free flaw in the Linux kernel's Qualcomm `ath12k` Wi-Fi driver, affecting `ath12k_mac_assign_vif_to_vdev()`. An `arvif` object created on another radio can be freed by `ath12k_mac_unassign_link_vif()` and subsequently dereferenced. The vulnerability was introduced in Linux 6.10 and fixed upstream in stable kernel 6.13.2 and 6.14-rc1; the Linux kernel CVE team recommends upgrading to a current stable release rather than applying the isolated fix. Red Hat assigned the vulnerability a CVSS v3.1 score of 6.7 and states exploitation requires local root privileges. Fixes are available for RHEL 9 and RHEL 10 through advisories `RHSA-2025:20518` and `RHSA-2025:20095`; RHEL 6, 7, 7 kernel-rt, 8, and 8 kernel-rt are not affected, while RHEL 9 kernel-rt is listed as will not fix.
Aug 26, 2026
**CVE-2023-52800** is a low-severity use-after-free vulnerability in the Linux kernel's `ath11k` Wi-Fi driver. In HTTP packet-log handling within `drivers/net/wireless/ath/ath11k/dp_rx.c`, code accessed RCU-protected active physical-device data through `ath11k_mac_get_ar_by_pdev_id()` without an RCU read-side critical section. The flaw, introduced in kernel 5.6, requires local access and high privileges; Red Hat assigned CVSS 4.4, citing potential availability impact with no confidentiality or integrity impact. Upstream fixes are available in Linux 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, 6.7, and later stable releases, and maintainers recommend updating to a current stable kernel rather than cherry-picking the patch. Red Hat remediated affected Red Hat Enterprise Linux 8 kernels through **RHSA-2024:7000**; RHEL 6 and 7 were assessed as not affected, while fixes for RHEL 8 `kernel-rt` and RHEL 9 kernel variants were deferred.
Aug 26, 2026
**CVE-2023-52798** is a use-after-free vulnerability in the Linux kernel's `ath11k` Wi-Fi driver, affecting DFS radar-event handling in `drivers/net/wireless/ath/ath11k/wmi.c`. Code invoking `ath11k_mac_get_ar_by_pdev_id()` accessed RCU-protected active physical-device data without an RCU read-side critical section, risking access to data after it had been freed. The flaw was introduced in Linux kernel 5.6. Upstream fixes mark the affected operation as an RCU read-side critical section and are available in kernel versions 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later stable releases. Red Hat rated the issue **Low** severity with a CVSS v3.1 score of 4.4, requiring local access and high privileges; RHEL 8 is fixed through `RHSA-2024:7000`, while RHEL 6 and 7 are unaffected and fixes for certain RHEL 8/9 real-time and RHEL 9 kernels were deferred.
Aug 26, 2026