CVE-2022-50034
published 2025-06-18CVE-2022-50034: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.16%
5.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3 fix use-after-free at workaround 2
BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac
cdns3_wa2_remove_old_request()
{
...
kfree(priv_req->request.buf);
cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
list_del_init(&priv_req->list);
^^^ use after free
...
}
cdns3_gadget_ep_free_request() free the space pointed by priv_req,
but priv_req is used in the following list_del_init().
This patch move list_del_init() before cdns3_gadget_ep_free_request().
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 8bc1901ca7b07d864fca11461b3875b31f949765 < e65d9b7147d7be3504893ca7dfb85286bda83d40 | e65d9b7147d7be3504893ca7dfb85286bda83d40 |
| linux | linux | >= 8bc1901ca7b07d864fca11461b3875b31f949765 < 6d7ac60098b206d0472475b666cb09d556bec03d | 6d7ac60098b206d0472475b666cb09d556bec03d |
| linux | linux | >= 8bc1901ca7b07d864fca11461b3875b31f949765 < c3c1dbad3a2db32ecf371c97f2058491b8ba0f9a | c3c1dbad3a2db32ecf371c97f2058491b8ba0f9a |
| linux | linux | >= 8bc1901ca7b07d864fca11461b3875b31f949765 < 6fd50446e7c9a98b4bcf96815f5c9602a16ea472 | 6fd50446e7c9a98b4bcf96815f5c9602a16ea472 |
| linux | linux | >= 8bc1901ca7b07d864fca11461b3875b31f949765 < 7d602f30149a117eea260208b1661bc404c21dfd | 7d602f30149a117eea260208b1661bc404c21dfd |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 5.11 < 5.15.63 | 5.15.63 |
| linux | linux_kernel | >= 5.16 < 5.19.4 | 5.19.4 |
| linux | linux_kernel | >= 5.3 < 5.4.211 | 5.4.211 |
| linux | linux_kernel | >= 5.5 < 5.10.138 | 5.10.138 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-50034: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in
osv·2025-06-18·CVSS 7.8
CVE-2022-50034 [HIGH] CVE-2022-50034: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac cdns3_wa2_remove_old_request() { ... kfree(priv_req->request.buf); cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ^^^ use after free ... } cdns3_gadget_ep_free_request() free the space pointed by priv_req, but priv_req is used in the following list_del_init(). This patch move list_del_init() before cdns3_gadget_ep_free_request().
GHSA
GHSA-7fcf-99gr-mjr2: In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3 fix use-after-free at workaround 2
BUG: KFENCE: use-after-free read i
ghsa_unreviewed·2025-06-18
CVE-2022-50034 [HIGH] CWE-416 GHSA-7fcf-99gr-mjr2: In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3 fix use-after-free at workaround 2
BUG: KFENCE: use-after-free read i
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3 fix use-after-free at workaround 2
BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac
cdns3_wa2_remove_old_request()
{
...
kfree(priv_req->request.buf);
cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
list_del_init(&priv_req->list);
^^^ use after free
...
}
cdns3_gadget_ep_free_request() free the space pointed by priv_req,
but priv_req is used in the following list_del_init().
This patch move list_del_init() before cdns3_gadget_ep_free_request().
Red Hat
kernel: usb: cdns3 fix use-after-free at workaround 2
vendor_redhat·2025-06-18·CVSS 7.8
CVE-2022-50034 [HIGH] kernel: usb: cdns3 fix use-after-free at workaround 2
kernel: usb: cdns3 fix use-after-free at workaround 2
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3 fix use-after-free at workaround 2
BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac
cdns3_wa2_remove_old_request()
{
...
kfree(priv_req->request.buf);
cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
list_del_init(&priv_req->list);
^^^ use after free
...
}
cdns3_gadget_ep_free_request() free the space pointed by priv_req,
but priv_req is used in the following list_del_init().
This patch move list_del_init() before cdns3_gadget_ep_free_request().
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not
Debian
CVE-2022-50034: linux - In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 ...
vendor_debian·2022·CVSS 7.8
CVE-2022-50034 [HIGH] CVE-2022-50034: linux - In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 ...
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac cdns3_wa2_remove_old_request() { ... kfree(priv_req->request.buf); cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ^^^ use after free ... } cdns3_gadget_ep_free_request() free the space pointed by priv_req, but priv_req is used in the following list_del_init(). This patch move list_del_init() before cdns3_gadget_ep_free_request().
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: resolved (fixed in 5.10.140-1)
forky: resolved (fixed in 6.0.2-1)
sid: resolved (fixed in 6.0.2-1)
trixie: resolved (fixed in 6.0.2-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/6d7ac60098b206d0472475b666cb09d556bec03dhttps://git.kernel.org/stable/c/6fd50446e7c9a98b4bcf96815f5c9602a16ea472https://git.kernel.org/stable/c/7d602f30149a117eea260208b1661bc404c21dfdhttps://git.kernel.org/stable/c/c3c1dbad3a2db32ecf371c97f2058491b8ba0f9ahttps://git.kernel.org/stable/c/e65d9b7147d7be3504893ca7dfb85286bda83d40
2025-06-18
Published