LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49980: USB: gadget: Fix use-after-free Read in usb_udc_uevent()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usb_udc_uevent() The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug: --------------------------------------------------------------- BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 Read of size 8 at addr ffff888078ce2050 by task udevd/2968 CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 dev_uevent+0x290/0x770 drivers/base/core.c:2424 --------------------------------------------------------------- The bug occurs because usb_udc_uevent() dereferences udc->driver but does so without acquiring the udc_lock mutex, which protects this field. If the gadget driver is unbound from the udc concurrently with uevent processing, the driver structure may be accessed after it has been deallocated. To prevent the race, we make sure that the routine holds the mutex around the racing accesses.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory-safety flaw in the USB gadget subsystem. A race during device event handling and gadget driver unregistration can make the kernel read memory after it has been freed. The public sources do not provide a CVSS score, confirmed exploitation, or a full impact statement.

Executive priority

Treat this as a kernel maintenance item unless your environment uses USB gadget functions heavily. The absence of known exploitation lowers urgency, but kernel memory bugs should still be remediated through normal patch cycles once vendor packages are available.

Technical view

usb_udc_uevent() dereferences udc->driver without holding udc_lock. Concurrent unbinding can free the gadget driver structure while uevent processing still reads it, producing a use-after-free read. The upstream fix holds the mutex around the racing access.

Likely exposure

Exposure appears limited to Linux systems running affected kernels with USB gadget/UDC functionality in use or available. Distro backports may change version-based conclusions, so teams should map exposure through vendor kernel advisories and installed kernel build metadata.

Exploitation context

The source bundle attributes discovery to syzbot fuzzing and states KEV is false. No cited source in the bundle confirms active exploitation, public weaponization, or a practical attack path.

Researcher notes

Evidence supports a synchronization bug and upstream locking fix, but not exploitability, privilege requirements, or impact beyond use-after-free read. Version data in the bundle is sparse, so validate affected ranges against upstream commits and downstream vendor backports.

Mitigation direction

  • Update to a vendor-supported kernel containing the referenced stable fixes or downstream backport.
  • Check Linux distribution advisories for CVE-2022-49980 applicability and package versions.
  • Prioritize systems that expose or rely on USB gadget/UDC functionality.
  • Do not rely on unconfirmed workarounds without vendor guidance.

Validation and detection

  • Inventory Linux kernel versions and distribution package release numbers.
  • Identify systems with USB gadget or UDC drivers enabled or required.
  • Confirm whether vendor kernels include the stable commits or equivalent backports.
  • Review kernel crash telemetry for related UAF or KASAN findings.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49980 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2ccea03a8f7ec93641791f2760d7cdc6cab6205f, 2ccea03a8f7ec93641791f2760d7cdc6cab6205funaffected
LinuxLinux3.1, 0, 5.19.7, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.