5.5

CVE-2022-48836: linux

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2022-48836DEBIAN-CVE-2022-48836
Published 16-07-2024Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2022-48836 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.6% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 11
RHSA-2024:7000RHSA-2024:7001SUSE-SU-2024:2892-1SUSE-SU-2024:2894-1SUSE-SU-2024:2901-1SUSE-SU-2024:2902-1

Timeline

  1. 16-07-2024
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: Input: aiptek - properly check endpoint type Syzbot reported warning in usb_submit_urb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the type of endpoint. Fix it by replacing old desc.bNumEndpoints check with usb_find_common_endpoints() helper for finding endpoints Fail log: usb 5-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: usb_hub_wq hub_event ... Call Trace: <TASK> aiptek_open+0xd5/0x130 drivers/input/tablet/aiptek.c:830 input_open_device+0x1bb/0x320 drivers/input/input.c:629 kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu98 products
  • linuxAll versions (No fix recorded) | < 4.4.0-259.293 | < 4.15.0-184.194 | < 5.4.0-117.132 | < 5.15.0-37.39
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1136.142 | < 4.4.0-1174.189 | < 4.15.0-1133.143 | < 5.4.0-1078.84 | < 5.15.0-1011.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96, < 57277a8b5d881e02051ba9d7f6cb3f915c229821 | ≥ 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96, < fc8033a55e2796d21e370260a784ac9fbb8305a6 | ≥ 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96, < 6de20111cd0bb7da9b2294073ba00c7d2a6c1c4f | ≥ 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96, < e732b0412f8c603d1e998f3bff41b5e7d5c3914c | ≥ 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96, < f0d43d22d24182b94d7eb78a2bf6ae7e2b33204a | ≥ 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96, < e762f57ff255af28236cd02ca9fc5c7e5a089d31 | ≥ 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96, < 35069e654bcab567ff8b9f0e68e1caf82c15dcd7 | ≥ 8e20cf2bce122ce9262d6034ee5d5b76fbb92f96, < 5600f6986628dde8881734090588474f54a540a8 | 90eb3c037fe3f0f25f01713a92725a8daa2b41f3 | a7c0ba06670f99c252d5bb74258dddbf50fef837 | ≥ 3.2.79, < 3.3 | ≥ 3.12.53, < 3.13 | 4.4
  • linux_kernel≥ 4.4, < 4.9.308 | ≥ 4.10, < 4.14.273 | ≥ 4.15, < 4.19.236 | ≥ 4.20, < 5.4.187 | ≥ 5.5, < 5.10.108 | ≥ 5.11, < 5.15.31 | ≥ 5.16, < 5.16.17
Debian1 product
  • linux< 5.17.3-1

3 vendors · 101 products

References

13 links
Show all 13 references