CVE-2022-49398: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
Vulnerability summary
CVE-2022-49398 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 19% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 26-02-2025PublishedVulnerability first disclosed.
- 23-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely removed without corrupting the list. However, when traversing the list and removing items using gadget giveback, the DWC3 lock is briefly released, allowing other routines to execute. There is a situation where, while items are being removed from the cancelled_list using dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable routine is running in parallel (due to UDC unbind). As the cleanup routine removes n, and the pullup disable removes n+1, once the cleanup retakes the DWC3 lock, it references a request who was already removed/handled. With list debug enabled, this leads to a panic. Ensure all instances of the macro are replaced where gadget giveback is used. Example call stack: Thread#1: __dwc3_gadget_ep_set_halt() - CLEAR HALT -> dwc3_gadget_ep_cleanup_cancelled_requests() ->list_for_each_entry_safe() ->dwc3_gadget_giveback(n) ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list] ->spin_unlock ->Thread#2 executes ... ->dwc3_gadget_giveback(n+1) ->Already removed! Thread#2: dwc3_gadget_pullup() ->waiting for dwc3 spin_lock ... ->Thread#1 released lock ->dwc3_stop_active_transfers() ->dwc3_remove_requests() ->fetches n+1 item from cancelled_list (n removed by Thread#1) ->dwc3_gadget_giveback() ->dwc3_gadget_del_and_unmap_request()- n+1 deleted[cancelled_list] ->spin_unlock
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.27% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu108 products
- linuxAll versions (No fix recorded) | < 5.15.0-48.54
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1020.24
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ d4f1afe5e896c18ae01099a85dab5e1a198bd2a8, < 1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a | ≥ d4f1afe5e896c18ae01099a85dab5e1a198bd2a8, < 2424307cdf421ac72075a1384eae4e4199ab6457 | ≥ d4f1afe5e896c18ae01099a85dab5e1a198bd2a8, < 26a7e6832afe9d9a991cfd9015177f083cf959cc | ≥ d4f1afe5e896c18ae01099a85dab5e1a198bd2a8, < bf594d1d0c1d7b895954018043536ffd327844f9 | d7ff2e3ff0e09d57b43014fe26b13bb3c9677254 | ≥ 4.19.57, < 4.20 | 5.0
- linux_kernel≥ 4.19.57, < 4.20 | ≥ 5.0, < 5.15.47 | ≥ 5.16, < 5.17.15 | ≥ 5.18, < 5.18.4
Debian1 product
- linux< 5.18.5-1
3 vendors · 111 products
