CVE-2022-50028
published 2025-06-18CVE-2022-50028: In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.17%
6.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
gadgetfs: ep_io - wait until IRQ finishes
after usb_ep_queue() if wait_for_completion_interruptible() is
interrupted we need to wait until IRQ gets finished.
Otherwise complete() from epio_complete() can corrupt stack.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 67a4874461422e633236a0286a01b483cd647113 | 67a4874461422e633236a0286a01b483cd647113 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 118d967ce00a3d128bf731b35e4e2cb0facf5f00 | 118d967ce00a3d128bf731b35e4e2cb0facf5f00 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 77040efe59a141286d090c8a0d37c65a355a1832 | 77040efe59a141286d090c8a0d37c65a355a1832 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ca06b4cde54f8ec8be3aa53fd339bd56e62c12b3 | ca06b4cde54f8ec8be3aa53fd339bd56e62c12b3 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9ac14f973cb91f0c01776517e6d50981f32b8038 | 9ac14f973cb91f0c01776517e6d50981f32b8038 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 94aadba8d000d5de56af4ce8da3f334f21bf7a79 | 94aadba8d000d5de56af4ce8da3f334f21bf7a79 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2b06d5d97c0e067108a122986767731d40742138 | 2b06d5d97c0e067108a122986767731d40742138 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 04cb742d4d8f30dc2e83b46ac317eec09191c68e | 04cb742d4d8f30dc2e83b46ac317eec09191c68e |
| linux | linux_kernel | < 4.9.326 | 4.9.326 |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 4.10 < 4.14.291 | 4.14.291 |
| linux | linux_kernel | >= 4.15 < 4.19.256 | 4.19.256 |
| linux | linux_kernel | >= 4.20 < 5.4.211 | 5.4.211 |
| linux | linux_kernel | >= 5.11 < 5.15.63 | 5.15.63 |
| linux | linux_kernel | >= 5.16 < 5.19.4 | 5.19.4 |
| linux | linux_kernel | >= 5.5 < 5.10.138 | 5.10.138 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: gadgetfs: ep_io - wait until IRQ finishes
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50028 [MEDIUM] CWE-121 kernel: gadgetfs: ep_io - wait until IRQ finishes
kernel: gadgetfs: ep_io - wait until IRQ finishes
In the Linux kernel, the following vulnerability has been resolved:
gadgetfs: ep_io - wait until IRQ finishes
after usb_ep_queue() if wait_for_completion_interruptible() is
interrupted we need to wait until IRQ gets finished.
Otherwise complete() from epio_complete() can corrupt stack.
A flaw was found in the gadgetfs module in the Linux kernel. If the wait_for_completion_interruptible() function is interrupted, the driver does not wait for the interrupt to finish, causing stack corruption and resulting in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].
[1]. https://access.redhat.com/errata/RHSA-2023:2458
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Packa
Debian
CVE-2022-50028: linux - In the Linux kernel, the following vulnerability has been resolved: gadgetfs: e...
vendor_debian·2022·CVSS 5.5
CVE-2022-50028 [MEDIUM] CVE-2022-50028: linux - In the Linux kernel, the following vulnerability has been resolved: gadgetfs: e...
In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if wait_for_completion_interruptible() is interrupted we need to wait until IRQ gets finished. Otherwise complete() from epio_complete() can corrupt stack.
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: resolved (fixed in 5.10.140-1)
forky: resolved (fixed in 6.0.2-1)
sid: resolved (fixed in 6.0.2-1)
trixie: resolved (fixed in 6.0.2-1)
GHSA
GHSA-gfmv-fp2w-65v9: In the Linux kernel, the following vulnerability has been resolved:
gadgetfs: ep_io - wait until IRQ finishes
after usb_ep_queue() if wait_for_compl
ghsa_unreviewed·2025-06-18
CVE-2022-50028 [MEDIUM] GHSA-gfmv-fp2w-65v9: In the Linux kernel, the following vulnerability has been resolved:
gadgetfs: ep_io - wait until IRQ finishes
after usb_ep_queue() if wait_for_compl
In the Linux kernel, the following vulnerability has been resolved:
gadgetfs: ep_io - wait until IRQ finishes
after usb_ep_queue() if wait_for_completion_interruptible() is
interrupted we need to wait until IRQ gets finished.
Otherwise complete() from epio_complete() can corrupt stack.
OSV
CVE-2022-50028: In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if wait_for_complet
osv·2025-06-18·CVSS 5.5
CVE-2022-50028 [MEDIUM] CVE-2022-50028: In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if wait_for_complet
In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if wait_for_completion_interruptible() is interrupted we need to wait until IRQ gets finished. Otherwise complete() from epio_complete() can corrupt stack.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/04cb742d4d8f30dc2e83b46ac317eec09191c68ehttps://git.kernel.org/stable/c/118d967ce00a3d128bf731b35e4e2cb0facf5f00https://git.kernel.org/stable/c/2b06d5d97c0e067108a122986767731d40742138https://git.kernel.org/stable/c/67a4874461422e633236a0286a01b483cd647113https://git.kernel.org/stable/c/77040efe59a141286d090c8a0d37c65a355a1832https://git.kernel.org/stable/c/94aadba8d000d5de56af4ce8da3f334f21bf7a79https://git.kernel.org/stable/c/9ac14f973cb91f0c01776517e6d50981f32b8038https://git.kernel.org/stable/c/ca06b4cde54f8ec8be3aa53fd339bd56e62c12b3
2025-06-18
Published