cbcvebase.
CVE-2022-49954
published 2025-06-18

CVE-2022-49954: In the Linux kernel, the following vulnerability has been resolved: Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag syzbot is reporting hung…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
11.0th percentile
In the Linux kernel, the following vulnerability has been resolved: Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag syzbot is reporting hung task at __input_unregister_device() [1], for iforce_close() waiting at wait_event_interruptible() with dev->mutex held is blocking input_disconnect_device() from __input_unregister_device(). It seems that the cause is simply that commit c2b27ef672992a20 ("Input: iforce - wait for command completion when closing the device") forgot to call wake_up() after clear_bit(). Fix this problem by introducing a helper that calls clear_bit() followed by wake_up_all().

Affected

17 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.2-1 (bookworm)linux 6.0.2-1 (bookworm)
linuxlinux——
linuxlinux>= c2b27ef672992a206e5b221b8676972dd840ffa5 < d186c65599bff0222da37b9215784ddfe39f9e1bd186c65599bff0222da37b9215784ddfe39f9e1b
linuxlinux>= c2b27ef672992a206e5b221b8676972dd840ffa5 < b271090eea3899399e2adcf79c9c95367d472b03b271090eea3899399e2adcf79c9c95367d472b03
linuxlinux>= c2b27ef672992a206e5b221b8676972dd840ffa5 < df1b53bc799d58f79701c465505a206c72ad4ab8df1b53bc799d58f79701c465505a206c72ad4ab8
linuxlinux>= c2b27ef672992a206e5b221b8676972dd840ffa5 < b533b9d3a0d1327cbb31c201dc8dbbf98c8bfe3cb533b9d3a0d1327cbb31c201dc8dbbf98c8bfe3c
linuxlinux>= c2b27ef672992a206e5b221b8676972dd840ffa5 < 98e01215708b6d416345465c09dce2bd4868c67a98e01215708b6d416345465c09dce2bd4868c67a
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.148-15.10.148-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 2.6.34 < 5.4.2135.4.213
linuxlinux_kernel>= 5.11 < 5.15.665.15.66
linuxlinux_kernel>= 5.16 < 5.19.85.19.8
linuxlinux_kernel>= 5.5 < 5.10.1425.10.142

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.