CVE-2022-50220
published 2025-06-18CVE-2022-50220: In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.20%
10.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
usbnet: Fix linkwatch use-after-free on disconnect
usbnet uses the work usbnet_deferred_kevent() to perform tasks which may
sleep. On disconnect, completion of the work was originally awaited in
->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic
commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":
https://git.kernel.org/tglx/history/c/0f138bbfd83c
The change was made because back then, the kernel's workqueue
implementation did not allow waiting for a single work. One had to wait
for completion of *all* work by calling flush_scheduled_work(), and that
could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex
held in ->ndo_stop().
The commit solved one problem but created another: It causes a
use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c,
ax88179_178a.c, ch9200.c and smsc75xx.c:
* If the drivers receive a link change interrupt immediately before
disconnect, they raise EVENT_LINK_RESET in their (non-sleepable)
->status() callback and schedule usbnet_deferred_kevent().
* usbnet_deferred_kevent() invokes the driver's ->link_reset() callback,
which calls netif_carrier_{on,off}().
* That in turn schedules the work linkwatch_event().
Because usbnet_deferred_kevent() is awaited after unregister_netdev(),
netif_carrier_{on,off}() may operate on an unregistered netdev and
linkwatch_event() may run after free_netdev(), causing a use-after-free.
In 2010, usbnet was changed to only wait for a single instance of
usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf
("drivers/net: don't use flush_scheduled_work()").
Unfortunately the commit neglected to move the wait back to
->ndo_stop(). Rectify that omission at long last.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < d2d6b530d89b0a912148018027386aa049f0a309 | d2d6b530d89b0a912148018027386aa049f0a309 |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < e2a521a7dcc463c5017b4426ca0804e151faeff7 | e2a521a7dcc463c5017b4426ca0804e151faeff7 |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < 7f77dcbc030c2faa6d8e8a594985eeb34018409e | 7f77dcbc030c2faa6d8e8a594985eeb34018409e |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < 8b4588b8b00b299be16a35be67b331d8fdba03f3 | 8b4588b8b00b299be16a35be67b331d8fdba03f3 |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < 135199a2edd459d2b123144efcd7f9bcd95128e4 | 135199a2edd459d2b123144efcd7f9bcd95128e4 |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < 635fd8953e4309b54ca6a81bed1d4a87668694f4 | 635fd8953e4309b54ca6a81bed1d4a87668694f4 |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f | d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < db3b738ae5f726204876f4303c49cfdf4311403f | db3b738ae5f726204876f4303c49cfdf4311403f |
| linux | linux | >= 23f333a2bfafba80339315b724808982a9de57d9 < a69e617e533edddf3fa3123149900f36e0a6dc74 | a69e617e533edddf3fa3123149900f36e0a6dc74 |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 2.6.38 < 4.9.326 | 4.9.326 |
| linux | linux_kernel | >= 4.10 < 4.14.291 | 4.14.291 |
| linux | linux_kernel | >= 4.15 < 4.19.256 | 4.19.256 |
| linux | linux_kernel | >= 4.20 < 5.4.211 | 5.4.211 |
| linux | linux_kernel | >= 5.11 < 5.15.61 | 5.15.61 |
| linux | linux_kernel | >= 5.16 < 5.18.18 | 5.18.18 |
| linux | linux_kernel | >= 5.19 < 5.19.2 | 5.19.2 |
| linux | linux_kernel | >= 5.5 < 5.10.137 | 5.10.137 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rr3g-h623-26gf: In the Linux kernel, the following vulnerability has been resolved:
usbnet: Fix linkwatch use-after-free on disconnect
usbnet uses the work usbnet_d
ghsa_unreviewed·2025-06-18
CVE-2022-50220 [HIGH] CWE-416 GHSA-rr3g-h623-26gf: In the Linux kernel, the following vulnerability has been resolved:
usbnet: Fix linkwatch use-after-free on disconnect
usbnet uses the work usbnet_d
In the Linux kernel, the following vulnerability has been resolved:
usbnet: Fix linkwatch use-after-free on disconnect
usbnet uses the work usbnet_deferred_kevent() to perform tasks which may
sleep. On disconnect, completion of the work was originally awaited in
->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic
commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":
https://git.kernel.org/tglx/history/c/0f138bbfd83c
The change was made because back then, the kernel's workqueue
implementation did not allow waiting for a single work. One had to wait
for completion of *all* work by calling flush_scheduled_work(), and that
could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex
held in ->ndo_stop().
The commit solved one problem but created anoth
OSV
CVE-2022-50220: In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_def
osv·2025-06-18·CVSS 7.8
CVE-2022-50220 [HIGH] CVE-2022-50220: In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_def
In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock": https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: I
Red Hat
kernel: usbnet: Fix linkwatch use-after-free on disconnect
vendor_redhat·2025-06-18·CVSS 7.8
CVE-2022-50220 [HIGH] kernel: usbnet: Fix linkwatch use-after-free on disconnect
kernel: usbnet: Fix linkwatch use-after-free on disconnect
In the Linux kernel, the following vulnerability has been resolved:
usbnet: Fix linkwatch use-after-free on disconnect
usbnet uses the work usbnet_deferred_kevent() to perform tasks which may
sleep. On disconnect, completion of the work was originally awaited in
->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic
commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":
https://git.kernel.org/tglx/history/c/0f138bbfd83c
The change was made because back then, the kernel's workqueue
implementation did not allow waiting for a single work. One had to wait
for completion of *all* work by calling flush_scheduled_work(), and that
could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex
held in ->ndo_
Debian
CVE-2022-50220: linux - In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix...
vendor_debian·2022·CVSS 7.8
CVE-2022-50220 [HIGH] CVE-2022-50220: linux - In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix...
In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock": https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: I
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409ehttps://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32fhttps://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403fhttps://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7
2025-06-18
Published