cbcvebase.
CVE-2022-50202
published 2025-06-18

CVE-2022-50202: In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: defer device probing when resuming from hibernation syzbot is reporting hung…

PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
11.1th percentile
In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: defer device probing when resuming from hibernation syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count variable. Currently wait_for_device_probe() from snapshot_open() from misc_open() can sleep forever with misc_mtx held if probe_count cannot become 0. When a device is probed by hub_event() work function, probe_count is incremented before the probe function starts, and probe_count is decremented after the probe function completed. There are three cases that can prevent probe_count from dropping to 0. (a) A device being probed stopped responding (i.e. broken/malicious hardware). (b) A process emulating a USB device using /dev/raw-gadget interface stopped responding for some reason. (c) New device probe requests keeps coming in before existing device probe requests complete. The phenomenon syzbot is reporting is (b). A process which is holding system_transition_mutex and misc_mtx is waiting for probe_count to become 0 inside wait_for_device_probe(), but the probe function which is called from hub_event() work function is waiting for the processes which are blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface. This patch mitigates (b) by deferring wait_for_device_probe() from snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that the possibility of (b) remains as long as any thread which is emulating a USB device via /dev/raw-gadget interface can be blocked by uninterruptible blocking operations (e.g. mutex_lock()). Please also note that (a) and (c) are not addressed. Regarding (c), we should change the code to wait for only one device which contains the image for resuming from hibernation. I don't know how to address (a), for use of timeout for wait_for_device_probe() might result in loss of user data in the image. Maybe we should require the userland to wait for th

Affected

21 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.2-1 (bookworm)linux 6.0.2-1 (bookworm)
linuxlinux——
linuxlinux>= c751085943362143f84346d274e0011419c84202 < 8c90947e5f1801e6c7120021c6ea0f3ad6a4eb918c90947e5f1801e6c7120021c6ea0f3ad6a4eb91
linuxlinux>= c751085943362143f84346d274e0011419c84202 < 5a283b59bce72c05c60e9f0fa92a28b5b850d8bb5a283b59bce72c05c60e9f0fa92a28b5b850d8bb
linuxlinux>= c751085943362143f84346d274e0011419c84202 < 3c48d3067eaf878642276f053575a5c642600a503c48d3067eaf878642276f053575a5c642600a50
linuxlinux>= c751085943362143f84346d274e0011419c84202 < 003a456ae6f70bb97e436e02fc5105be577c1570003a456ae6f70bb97e436e02fc5105be577c1570
linuxlinux>= c751085943362143f84346d274e0011419c84202 < 2f0e18e0db42f4f8bc87d3d98333680065ceeff82f0e18e0db42f4f8bc87d3d98333680065ceeff8
linuxlinux>= c751085943362143f84346d274e0011419c84202 < b8e1ae9433d7bd95f2dcc044a7a6f20a4c40d258b8e1ae9433d7bd95f2dcc044a7a6f20a4c40d258
linuxlinux>= c751085943362143f84346d274e0011419c84202 < f7042cf9dd40733f387b7cac021e626c74b8856ff7042cf9dd40733f387b7cac021e626c74b8856f
linuxlinux>= c751085943362143f84346d274e0011419c84202 < 8386c414e27caba8501119948e9551e52b527f598386c414e27caba8501119948e9551e52b527f59
linuxlinux_kernel< 4.14.2914.14.291
linuxlinux_kernel>= 0 < 5.10.140-15.10.140-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 4.15 < 4.19.2564.19.256
linuxlinux_kernel>= 4.20 < 5.4.2115.4.211
linuxlinux_kernel>= 5.11 < 5.15.615.15.61
linuxlinux_kernel>= 5.16 < 5.18.185.18.18
linuxlinux_kernel>= 5.19 < 5.19.25.19.2
linuxlinux_kernel>= 5.5 < 5.10.1375.10.137

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.