Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash a system during USB gadget configuration changes involving RNDIS. The public record describes a use-after-free that leads to panic when a pullup callback fails. Business impact is most likely availability loss on affected Linux devices using USB gadget mode, especially embedded or device-mode USB products.
Executive priority
Treat as a targeted availability risk for Linux-based appliances, embedded devices, and USB gadget products. Prioritize patch validation where device uptime matters or field recovery is difficult. Broad enterprise server exposure is not established by the provided sources.
Technical view
The flaw is in Linux USB gadget handling during config switches from RNDIS to another configuration. If gadget->ops->pullup() fails or is unsupported, cleanup can call rndis_close() after related state is freed, causing a use-after-free and kernel panic. The source bundle names stable kernel commits as fixes but provides no CVSS or CWE.
Likely exposure
Exposure appears limited to Linux systems using USB gadget configfs with RNDIS functions and configuration switching or removal workflows. The source does not specify remote reachability or required privileges. Distribution kernels may differ because vendors often backport kernel fixes.
Exploitation context
CISA KEV status is false, and the supplied sources do not report active exploitation. The described trigger is operational: changing USB gadget configuration, unlinking an RNDIS function, then removing it after a pullup failure condition.
Researcher notes
Evidence supports a kernel use-after-free leading to panic, not a confirmed privilege escalation or remote exploit. The affected-version data is sparse, so validate against kernel tree commits and downstream vendor backports before declaring systems safe or vulnerable.
Mitigation direction
- Review vendor kernel advisories for CVE-2022-50704 and applicable backports.
- Update to a kernel containing the referenced stable fixes where available.
- Limit USB gadget configfs administration to trusted operators and automation.
- Avoid unnecessary RNDIS gadget reconfiguration on unpatched affected devices.
- Monitor affected embedded fleets for unexplained kernel panics during USB mode changes.
Validation and detection
- Inventory Linux devices using USB gadget mode and RNDIS functions.
- Compare running kernel builds against vendor advisories and referenced stable commits.
- Check whether gadget configuration workflows can remove or switch RNDIS functions.
- Review crash logs for rndis_close, gether_cleanup, or USB gadget panic traces.
- Confirm patched devices no longer carry the vulnerable kernel code path.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50704 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/30e926aa835ac2e6ad05822e4cb75833feb0d99fCVE reference, Linux
- https://git.kernel.org/stable/c/99a58ac42d9b6911834b0224b6782aea0c311346CVE reference, Linux
- https://git.kernel.org/stable/c/afdc12887f2b2ecf20d065a7d81ad29824155083CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.