cbcvebase.
CVE-2022-49313
published 2025-02-26

CVE-2022-49313: In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxu_bus_suspend() There is a deadlock in…

PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
10.6th percentile
In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxu_bus_suspend() There is a deadlock in oxu_bus_suspend(), which is shown below: (Thread 1) | (Thread 2) | timer_action() oxu_bus_suspend() | mod_timer() spin_lock_irq() //(1) | (wait a time) ... | oxu_watchdog() del_timer_sync() | spin_lock_irq() //(2) (wait timer to stop) | ... We hold oxu->lock in position (1) of thread 1, and use del_timer_sync() to wait timer to stop, but timer handler also need oxu->lock in position (2) of thread 2. As a result, oxu_bus_suspend() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irq(), which could let timer handler to obtain the needed lock.

Affected

23 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.18.5-1 (bookworm)linux 5.18.5-1 (bookworm)
linuxlinux——
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < 9b58d255f27b0ed6a2e43208960864d67579db589b58d255f27b0ed6a2e43208960864d67579db58
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < a3d380188bde8900c3f604e82b56572896499124a3d380188bde8900c3f604e82b56572896499124
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < f8242044c91cafbba9e320b0fb31abf2429a3221f8242044c91cafbba9e320b0fb31abf2429a3221
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < 2dcec0bc142be2096af71a5703d63237127db2042dcec0bc142be2096af71a5703d63237127db204
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < ffe9440d698274c6462d2e304562c6ddfc8c84dfffe9440d698274c6462d2e304562c6ddfc8c84df
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < d888753872190abd18f68a7d77b9c7c367f0a7abd888753872190abd18f68a7d77b9c7c367f0a7ab
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < 4187b291a76664a3c03d3f0d9bfadc83228818684187b291a76664a3c03d3f0d9bfadc8322881868
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < b97aae8b43b718314012e8170b7e03dbfd2e7677b97aae8b43b718314012e8170b7e03dbfd2e7677
linuxlinux>= b92a78e582b1a45649143dc86e526f5824092478 < 4d378f2ae58138d4c55684e1d274e7dd94aa65244d378f2ae58138d4c55684e1d274e7dd94aa6524
linuxlinux_kernel< 4.9.3184.9.318
linuxlinux_kernel>= 0 < 5.10.127-15.10.127-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 4.10 < 4.14.2834.14.283
linuxlinux_kernel>= 4.15 < 4.19.2474.19.247
linuxlinux_kernel>= 4.20 < 5.4.1985.4.198
linuxlinux_kernel>= 5.11 < 5.15.475.15.47
linuxlinux_kernel>= 5.16 < 5.17.155.17.15
linuxlinux_kernel>= 5.18 < 5.18.45.18.4
linuxlinux_kernel>= 5.5 < 5.10.1225.10.122

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.