Security readout for executives and security teams
Plain-English summary
CVE-2022-49755 is a Linux kernel use-after-free in USB gadget FunctionFS handling. A local user who can reach this kernel path could potentially crash the system or gain broader control. The issue matters most for embedded, mobile, appliance, and developer systems using USB gadget features, rather than ordinary remote-only servers.
Executive priority
Treat as high priority for Linux fleets that use USB gadget features or run untrusted local workloads. For standard servers without USB gadget exposure, handle through normal kernel patching cycles after confirming configuration.
Technical view
The bug is a race between ffs_ep0_write/ffs_ep0_read through ffs_ep0_queue_wait and functionfs_unbind during fast composition switching. functionfs_unbind can clear ep0req while queue-wait logic lacks a NULL check, causing use-after-free. The fix serializes execution with ffs->mutex. CVSS 3.1 is 7.8, local, low complexity, low privilege, no user interaction.
Likely exposure
Exposure is most likely where Linux USB gadget FunctionFS is enabled and accessible to local users or service contexts. Systems that do not use USB gadget functionality have lower practical exposure. The provided affected-version data is not fully normalized, so confirm exposure against distribution kernel advisories and the listed upstream stable fixes.
Exploitation context
The source bundle does not show CISA KEV listing or any cited active exploitation. The vulnerability is local, not network-reachable by itself. Exploitation would require access to the relevant USB gadget FunctionFS code path and race timing during composition switching.
Researcher notes
Evidence supports a kernel race leading to CWE-416 use-after-free. The source bundle names upstream stable commits but does not provide exploit evidence, distribution-specific fixed versions, or complete normalized affected ranges. Validate against actual kernel trees, configs, and vendor backports.
Mitigation direction
- Apply vendor kernel updates containing the listed upstream stable fixes.
- If patching is delayed, disable unused USB gadget FunctionFS functionality where feasible.
- Restrict untrusted local access on systems exposing USB gadget workflows.
- Check distribution advisories before assuming a custom kernel is fixed.
Validation and detection
- Inventory Linux kernel versions and compare them with vendor-fixed releases.
- Confirm whether USB gadget FunctionFS is enabled in kernel configuration.
- Check whether downstream kernel packages include the referenced stable commits.
- Prioritize embedded, mobile, appliance, and USB OTG systems for review.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49755 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/facf353c9e8d7885b686d9a4b173d4e0af6441d2CVE reference, Linux
- https://git.kernel.org/stable/c/e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4CVE reference, Linux
- https://git.kernel.org/stable/c/a8d40942df074f4ebcb9bd3413596d92f323b064CVE reference, Linux
- https://git.kernel.org/stable/c/6dd9ea05534f323668db94fcc2726c7a84547e78CVE reference, Linux
- https://git.kernel.org/stable/c/ae8e136bcaae96163b5821984de1036efc9abb1aCVE reference, Linux
- https://git.kernel.org/stable/c/6aee197b7fbcd61596a78b47d553f2f99111f217CVE reference, Linux
- https://git.kernel.org/stable/c/6a19da111057f69214b97c62fb0ac59023970850CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.