In the Linux kernel, the following vulnerability has been resolved:
wifi: at76c50x: fix use after free access in at76_disconnect
The memory pointed to by priv is freed at the end of at76deletedevice function (using ieee80211freehw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168844742083861073661921756953986486526",
"334285795496363402003004430492690961851",
"50690228162561092828515085361778752128",
"160247150837431011771506054073884912199"
]
},
"id": "CVE-2025-37796-05d7a8fc",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@152721cbae42713ecfbca6847e0f102ee6b19546",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168844742083861073661921756953986486526",
"334285795496363402003004430492690961851",
"50690228162561092828515085361778752128",
"160247150837431011771506054073884912199"
]
},
"id": "CVE-2025-37796-08b7c90d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 283.0,
"function_hash": "245741841671739779087641406441177516100"
},
"id": "CVE-2025-37796-0ae93a84",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c619aec1f538333b56746d2f796aab1bca5c9a5",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c",
"function": "at76_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 283.0,
"function_hash": "245741841671739779087641406441177516100"
},
"id": "CVE-2025-37796-0ae94602",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c",
"function": "at76_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 283.0,
"function_hash": "245741841671739779087641406441177516100"
},
"id": "CVE-2025-37796-0babc021",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e7df74745700f059dc117a620e566964a2e8f2c",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c",
"function": "at76_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 283.0,
"function_hash": "245741841671739779087641406441177516100"
},
"id": "CVE-2025-37796-2017e8f0",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ca513631fa6ad3011b8b9197cdde0f351103704",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c",
"function": "at76_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 283.0,
"function_hash": "245741841671739779087641406441177516100"
},
"id": "CVE-2025-37796-5537771a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c",
"function": "at76_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 283.0,
"function_hash": "245741841671739779087641406441177516100"
},
"id": "CVE-2025-37796-59ffec2c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@152721cbae42713ecfbca6847e0f102ee6b19546",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c",
"function": "at76_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168844742083861073661921756953986486526",
"334285795496363402003004430492690961851",
"50690228162561092828515085361778752128",
"160247150837431011771506054073884912199"
]
},
"id": "CVE-2025-37796-6a314b37",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ca513631fa6ad3011b8b9197cdde0f351103704",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168844742083861073661921756953986486526",
"334285795496363402003004430492690961851",
"50690228162561092828515085361778752128",
"160247150837431011771506054073884912199"
]
},
"id": "CVE-2025-37796-9812088d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e7df74745700f059dc117a620e566964a2e8f2c",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168844742083861073661921756953986486526",
"334285795496363402003004430492690961851",
"50690228162561092828515085361778752128",
"160247150837431011771506054073884912199"
]
},
"id": "CVE-2025-37796-b7319bab",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 283.0,
"function_hash": "245741841671739779087641406441177516100"
},
"id": "CVE-2025-37796-beac2a2f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9682bfef2cf3802515a902e964d774e137be1b9",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c",
"function": "at76_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168844742083861073661921756953986486526",
"334285795496363402003004430492690961851",
"50690228162561092828515085361778752128",
"160247150837431011771506054073884912199"
]
},
"id": "CVE-2025-37796-ef4fef41",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9682bfef2cf3802515a902e964d774e137be1b9",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 283.0,
"function_hash": "245741841671739779087641406441177516100"
},
"id": "CVE-2025-37796-f0d8794a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c",
"function": "at76_disconnect"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168844742083861073661921756953986486526",
"334285795496363402003004430492690961851",
"50690228162561092828515085361778752128",
"160247150837431011771506054073884912199"
]
},
"id": "CVE-2025-37796-f6d92217",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168844742083861073661921756953986486526",
"334285795496363402003004430492690961851",
"50690228162561092828515085361778752128",
"160247150837431011771506054073884912199"
]
},
"id": "CVE-2025-37796-fbf7cf99",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c619aec1f538333b56746d2f796aab1bca5c9a5",
"target": {
"file": "drivers/net/wireless/atmel/at76c50x-usb.c"
}
}
]