CVE-2022-48926

usb: gadget: rndis: add spinlock for rndis response list

HIGH

7.8

CVSS Score

Published: August 22, 2024 at 03:31 AM UTC

Updated: June 17, 2026 at 05:16 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: add spinlock for rndis response list There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below. It's better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list. [ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0). [ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.10 ≤ v < 4.14.2694.15 ≤ v < 4.19.2324.20 ≤ v < 5.4.1824.6 ≤ v < 4.14.2694.6 ≤ v < 4.19.2324.6 ≤ v < 4.9.3044.6 ≤ v < 5.10.1034.6 ≤ v < 5.15.264.6 ≤ v < 5.16.124.6 ≤ v < 5.174.6 ≤ v < 5.4.1825.11 ≤ v < 5.15.265.16 ≤ v < 5.16.125.5 ≤ v < 5.10.1034.6f6281af9d62e128aa6efad29cf7265062af114f2

Vendor states this is fixed in 33222d1571d7ce8c1c75f6b488f38968fa93d2d9 (fixed)

Vendor states this is fixed in 4ce247af3f30078d5b97554f1ae6200a0222c15a (fixed)

Vendor states this is fixed in 669c2b178956718407af5631ccbc61c24413f038 (fixed)

Vendor states this is fixed in 9ab652d41deab49848673c3dadb57ad338485376 (fixed)

Vendor states this is fixed in 9f5d8ba538ef81cd86ea587ca3f8c77e26bea405 (fixed)

Vendor states this is fixed in 9f688aadede6b862a0a898792b1a35421c93636f (fixed)

Vendor states this is fixed in aaaba1c86d04dac8e49bf508b492f81506257da3 (fixed)

Vendor states this is fixed in da514063440b53a27309a4528b726f92c3cfe56f (fixed)

Vendor states this is fixed in 4.14.269 (unaffected)

Vendor states this is fixed in 4.19.232 (unaffected)

Vendor states this is fixed in 4.6 (unaffected)

Vendor states this is fixed in 4.9.304 (unaffected)