CVE-2022-49503

A flaw was found in the Linux kernel's ath9k_htc component. This vulnerability allows a local attacker to cause a denial of service or potentially disclose sensitive information via passing untrusted data to test_bit().

This vulnerability is evaluated with a Moderate severity impact because triggering the condition requires specialized USB wireless network hardware that is not commonly connected or active in enterprise environments. The issue stems from improper validation of received frame metadata within the Atheros wireless driver, which can cause an out-of-bounds memory read leading to a kernel crash or information exposure. Typical server installations and virtualized platforms do not load this driver by default unless the corresponding physical hardware is attached.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.