Security readout for executives and security teams
Plain-English summary
A timing flaw in Linux USB gadgetfs can leave an interrupt handler using stack data after the waiting operation has ended, corrupting kernel memory. Successful abuse could affect confidentiality, integrity, and availability. The supplied CVSS indicates that an attacker needs low-privileged local access; this is not described as a remote, internet-facing vulnerability.
Executive priority
Treat this as an accelerated, exposure-based patching item. Prioritize multi-user systems, embedded devices, and USB gadget hosts where untrusted local users can reach gadgetfs. It does not warrant internet-wide emergency response based solely on the supplied evidence, but kernel memory corruption justifies prompt remediation where prerequisites exist.
Technical view
If gadgetfs ep_io is interrupted after usb_ep_queue(), it can return before the USB request's IRQ completion finishes. epio_complete() may then call complete() against expired stack state, causing stack corruption. The upstream resolution waits for IRQ completion before allowing that state to leave scope.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel where gadgetfs endpoint I/O is enabled and reachable by low-privileged local users. The record names several versions from 2.6.12 through 6.0, but its formatting is insufficient to infer exact continuous affected ranges or distribution package versions.
Exploitation context
The CVSS vector describes local access, low complexity, low privileges, and no user interaction. The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public proof of concept. Absence from these sources does not prove exploitation is impossible.
Researcher notes
This is an asynchronous lifetime race involving interruption of a completion wait and later IRQ completion against stack-backed state. The linked stable commits are the strongest remediation evidence supplied. Exact exploitability, affected configuration requirements, distribution backports, and real-world attack prevalence are not established by the bundle.
Mitigation direction
- Apply the applicable upstream stable fix or a vendor kernel package containing its backport.
- Consult the Linux distribution or device vendor for exact fixed package versions.
- Until updated, limit untrusted local access to systems exposing gadgetfs where operationally feasible.
- After updating, boot the fixed kernel and confirm it is the active version.
Validation and detection
- Inventory running kernel builds on systems that support USB gadget functionality.
- Determine whether gadgetfs is configured and accessible to low-privileged local users.
- Map each kernel build to an applicable linked stable commit or documented vendor backport.
- After remediation, verify the active kernel contains the fix and test USB gadget workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50028 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/67a4874461422e633236a0286a01b483cd647113CVE reference, Linux
- https://git.kernel.org/stable/c/118d967ce00a3d128bf731b35e4e2cb0facf5f00CVE reference, Linux
- https://git.kernel.org/stable/c/77040efe59a141286d090c8a0d37c65a355a1832CVE reference, Linux
- https://git.kernel.org/stable/c/ca06b4cde54f8ec8be3aa53fd339bd56e62c12b3CVE reference, Linux
- https://git.kernel.org/stable/c/9ac14f973cb91f0c01776517e6d50981f32b8038CVE reference, Linux
- https://git.kernel.org/stable/c/94aadba8d000d5de56af4ce8da3f334f21bf7a79CVE reference, Linux
- https://git.kernel.org/stable/c/2b06d5d97c0e067108a122986767731d40742138CVE reference, Linux
- https://git.kernel.org/stable/c/04cb742d4d8f30dc2e83b46ac317eec09191c68eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.