LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50132: usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer and its dereference with priv_ep->cdns3_dev may cause panic. Found by Linux Verification Center (linuxtesting.org) with SVACE.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50132 is a Linux kernel bug in the Cadence USB3 gadget driver. A NULL endpoint value can be converted and dereferenced, potentially causing a kernel panic. The public record does not show remote code execution, data theft, or active exploitation. Business impact is primarily availability risk on systems using this USB gadget functionality.

Executive priority

Treat as a targeted availability issue, not a broad enterprise emergency. Prioritize patching for embedded products, appliances, and operational systems where a kernel panic could interrupt service. Standard Linux server fleets are lower priority unless they use the affected USB gadget driver path.

Technical view

The flaw is in cdns3_gadget_ep_dequeue() and cdns3_gadget_ep_enable(). ep_to_cdns3_ep(ep) could be evaluated before confirming ep is not NULL, making priv_ep invalid and later dereferencing priv_ep->cdns3_dev. Kernel stable commits move the priv_ep assignment after the NULL check.

Likely exposure

Exposure appears limited to Linux systems with the Cadence USB3 gadget driver path in use. This is more relevant to embedded, appliance, mobile, or USB device-mode systems than general servers. The supplied affected-version data is incomplete and should be confirmed against distribution kernel advisories.

Exploitation context

No CISA KEV listing is provided, and the source bundle cites no active exploitation. The described outcome is a possible kernel panic, so the credible impact is denial of service. Public sources do not establish practical attack prerequisites or remote reachability.

Researcher notes

The CVE record lacks CVSS, CWE, and detailed exploitability conditions. The bug was found by Linux Verification Center using SVACE. Analysis should focus on reachable call paths for NULL ep in cdns3 gadget operations and whether downstream kernels carry the stable fixes.

Mitigation direction

  • Apply Linux kernel or distribution updates that include the referenced stable fixes.
  • Prioritize devices using Cadence USB3 gadget or USB device-mode functionality.
  • Check vendor advisories for backported fixes and supported kernel package versions.
  • If patching is delayed, review whether the affected USB gadget functionality can be disabled.

Validation and detection

  • Inventory Linux systems using Cadence USB3 gadget or USB device-mode drivers.
  • Confirm the running kernel includes one of the referenced stable fix commits or vendor backport.
  • Review distribution security notices for CVE-2022-50132 coverage.
  • Monitor kernel logs for unexplained panics on relevant USB gadget systems.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50132 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7733f6c32e36ff9d7adadf40001039bf219b1cbe, 7733f6c32e36ff9d7adadf40001039bf219b1cbe, 7733f6c32e36ff9d7adadf40001039bf219b1cbe, 7733f6c32e36ff9d7adadf40001039bf219b1cbe, 7733f6c32e36ff9d7adadf40001039bf219b1cbeunaffected
LinuxLinux5.4, 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.