CVE-2022-49755

usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait

State: Published
Severity: 7.8 High
Published: Mar 27, 2025
Updated: Aug 5, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait

While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind.

Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.

Fix this by making a serialized execution between the two functions using a mutex_lock(ffs->mutex).

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before facf353c9e8d7885b686d9a4b173d4e0af6441d2Affected ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4Affected ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before a8d40942df074f4ebcb9bd3413596d92f323b064Affected ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before 6dd9ea05534f323668db94fcc2726c7a84547e78Affected ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before ae8e136bcaae96163b5821984de1036efc9abb1aAffected ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before 6aee197b7fbcd61596a78b47d553f2f99111f217Affected ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before 6a19da111057f69214b97c62fb0ac59023970850Affected
LinuxLinux	2.6.35Affected before 2.6.35Not affected 4.14.305 through 4.14.Not affected 4.19.272 through 4.19.Not affected 5.4.231 through 5.4.Not affected 5.10.166 through 5.10.Not affected 5.15.91 through 5.15.Not affected 6.1.9 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before facf353c9e8d7885b686d9a4b173d4e0af6441d2Affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4Affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before a8d40942df074f4ebcb9bd3413596d92f323b064Affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before 6dd9ea05534f323668db94fcc2726c7a84547e78Affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before ae8e136bcaae96163b5821984de1036efc9abb1aAffected
ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before 6aee197b7fbcd61596a78b47d553f2f99111f217Affected
ddf8abd2599491cbad959c700b90ba72a5dce8d0 to before 6a19da111057f69214b97c62fb0ac59023970850Affected

LinuxLinux

2.6.35Affected
before 2.6.35Not affected
4.14.305 through 4.14.*Not affected
4.19.272 through 4.19.*Not affected
5.4.231 through 5.4.*Not affected
5.10.166 through 5.10.*Not affected
5.15.91 through 5.15.*Not affected
6.1.9 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.