CVE-2022-49398
usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely removed without corrupting the list. However, when traversing the list and removing items using gadget giveback, the DWC3 lock is briefly released, allowing other routines to execute. There is a situation where, while items are being removed from the cancelled_list using dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable routine is running in parallel (due to UDC unbind). As the cleanup routine removes n, and the pullup disable removes n+1, once the cleanup retakes the DWC3 lock, it references a request who was already removed/handled. With list debug enabled, this leads to a panic. Ensure all instances of the macro are replaced where gadget giveback is used. Example call stack: Thread#1: __dwc3_gadget_ep_set_halt() - CLEAR HALT -> dwc3_gadget_ep_cleanup_cancelled_requests() ->list_for_each_entry_safe() ->dwc3_gadget_giveback(n) ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list] ->spin_unlock ->Thread#2 executes ... ->dwc3_gadget_giveback(n+1) ->Already removed! Thread#2: dwc3_gadget_pullup() ->waiting for dwc3 spin_lock ... ->Thread#1 released lock ->dwc3_stop_active_transfers() ->dwc3_remove_requests() ->fetches n+1 item from cancelled_list (n removed by Thread#1) ->dwc3_gadget_giveback() ->dwc3_gadget_del_and_unmap_request()- n+1 deleted[cancelled_list] ->spin_unlock
Timeline
ID reserved
By Linux
Published
- 15 months later
· 15 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.27% · top 81% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected d4f1afe5e896c18ae01099a85dab5e1a198bd2a8 – < 1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a
- affected d4f1afe5e896c18ae01099a85dab5e1a198bd2a8 – < 2424307cdf421ac72075a1384eae4e4199ab6457
- affected d4f1afe5e896c18ae01099a85dab5e1a198bd2a8 – < 26a7e6832afe9d9a991cfd9015177f083cf959cc
- affected d4f1afe5e896c18ae01099a85dab5e1a198bd2a8 – < bf594d1d0c1d7b895954018043536ffd327844f9
- affected d7ff2e3ff0e09d57b43014fe26b13bb3c9677254
- affected 4.19.57 – < 4.20
- affected 5.0
- unaffected < 5.0
- unaffected 5.15.47 – ≤ 5.15.*
- unaffected 5.17.15 – ≤ 5.17.*
- unaffected 5.18.4 – ≤ 5.18.*
- unaffected 5.19 – ≤ *
References (4)
- https://git.kernel.org/stable/c/1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a (opens in a new tab)
- https://git.kernel.org/stable/c/2424307cdf421ac72075a1384eae4e4199ab6457 (opens in a new tab)
- https://git.kernel.org/stable/c/26a7e6832afe9d9a991cfd9015177f083cf959cc (opens in a new tab)
- https://git.kernel.org/stable/c/bf594d1d0c1d7b895954018043536ffd327844f9 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-49398)Record last updated .