LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48948: usb: gadget: uvc: Prevent buffer overflow in setup handler

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-48948 is a Linux kernel USB video gadget flaw. A request handler can accept more data than the target buffer holds, causing a small overflow. The likely business impact is concentrated in Linux-based devices that expose USB gadget UVC behavior, not ordinary systems with no such function enabled.

Executive priority

Treat as targeted infrastructure hygiene for Linux-based USB video devices. It is not supported as internet-scale emergency risk by the provided evidence, but affected embedded or appliance fleets should be patched through normal kernel maintenance channels.

Technical view

The vulnerable path is in usb gadget UVC setup handling. The setup path allows up to 64 bytes, while the OUT data-stage handler copies req->actual into a 60-byte uvc_event data array, creating a possible 4-byte overflow. Kernel stable commits are referenced as fixes.

Likely exposure

Exposure is most likely on Linux kernels configured to use USB gadget UVC, commonly device-side USB video behavior. The bundle does not identify specific distributions, appliances, or cloud exposure. Systems without this kernel feature enabled appear less likely to be exposed.

Exploitation context

The bundle provides no CVSS, CWE, public exploit details, or CISA KEV listing. Active exploitation should not be assumed. Practical exploitation would depend on reaching the affected USB gadget control path, which is an important scoping constraint.

Researcher notes

Key uncertainty remains severity and exploitability. The public record supplied describes the memory safety bug and fix commits, but not impact beyond overflow mechanics. Validate reachability before assigning broad risk, especially on systems that do not operate as USB gadgets.

Mitigation direction

  • Update affected Linux kernels using vendor or upstream stable guidance.
  • Prioritize devices exposing USB gadget UVC functionality.
  • Disable USB gadget UVC where it is not operationally required.
  • Check distribution or device vendor advisories for packaged fixed versions.
  • Track the referenced kernel stable commits in downstream kernels.

Validation and detection

  • Inventory devices running Linux kernels with USB gadget UVC enabled.
  • Compare kernel versions against vendor fixed releases or referenced stable commits.
  • Confirm whether exposed products use the affected usb gadget UVC path.
  • Review vendor advisories for backported fixes and package status.
  • Document exceptions where the feature is absent or disabled.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48948 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcdda479f15cd13fa50a913ca85129c0437cc7b91, cdda479f15cd13fa50a913ca85129c0437cc7b91, cdda479f15cd13fa50a913ca85129c0437cc7b91, cdda479f15cd13fa50a913ca85129c0437cc7b91, cdda479f15cd13fa50a913ca85129c0437cc7b91, cdda479f15cd13fa50a913ca85129c0437cc7b91, cdda479f15cd13fa50a913ca85129c0437cc7b91, cdda479f15cd13fa50a913ca85129c0437cc7b91, cdda479f15cd13fa50a913ca85129c0437cc7b91unaffected
LinuxLinux2.6.35, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.161, 5.15.85, 6.0.15, 6.1.1, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.