CVE-2022-50568

published 2025-10-22

CVE-2022-50568: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: fix f_hidg lifetime vs cdev The embedded struct cdev does not have its…

Priority P4 21

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_hid: fix f_hidg lifetime vs cdev

The embedded struct cdev does not have its lifetime correctly tied to
the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN
is held open while the gadget is deleted.

This can readily be replicated with libusbgx's example programs (for
conciseness - operating directly via configfs is equivalent):

gadget-hid
exec 3<> /dev/hidg0
gadget-vid-pid-remove
exec 3<&-

Pull the existing device up in to struct f_hidg and make use of the
cdev_device_{add,del}() helpers. This changes the lifetime of the
device object to match struct f_hidg, but note that it is still added
and deleted at the same time.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.4-1 (bookworm)	linux 6.1.4-1 (bookworm)
linux	linux	—	—
linux	linux	>= 71adf118946957839a13aa4d1094183e05c6c094 < 1cd7f156f6389918f760687fbbf133c86da93162	1cd7f156f6389918f760687fbbf133c86da93162
linux	linux	>= 71adf118946957839a13aa4d1094183e05c6c094 < c78c87c4e389b62f8892af7f59857447aa6d9797	c78c87c4e389b62f8892af7f59857447aa6d9797
linux	linux	>= 71adf118946957839a13aa4d1094183e05c6c094 < 1b6a53e447ec3d81623610c8c7ec5082b47dfdce	1b6a53e447ec3d81623610c8c7ec5082b47dfdce
linux	linux	>= 71adf118946957839a13aa4d1094183e05c6c094 < d3136b79705c2e3bba9c76adc5628af0215d798e	d3136b79705c2e3bba9c76adc5628af0215d798e
linux	linux	>= 71adf118946957839a13aa4d1094183e05c6c094 < 9e4b85d815b14bd4db2deea2a54264a23de8b896	9e4b85d815b14bd4db2deea2a54264a23de8b896
linux	linux	>= 71adf118946957839a13aa4d1094183e05c6c094 < 9e08b7f5fa00e9d550851352bd0d1ba74ccffef2	9e08b7f5fa00e9d550851352bd0d1ba74ccffef2
linux	linux	>= 71adf118946957839a13aa4d1094183e05c6c094 < 89ff3dfac604614287ad5aad9370c3f984ea3f4b	89ff3dfac604614287ad5aad9370c3f984ea3f4b
linux	linux_kernel	>= 0 < 5.10.178-1	5.10.178-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 2.6.35 < 4.19.270	4.19.270
linux	linux_kernel	>= 4.20.0 < 5.4.229	5.4.229
linux	linux_kernel	>= 5.11.0 < 5.15.86	5.15.86
linux	linux_kernel	>= 5.16.0 < 6.0.16	6.0.16
linux	linux_kernel	>= 5.5.0 < 5.10.163	5.10.163
linux	linux_kernel	>= 6.1.0 < 6.1.2	6.1.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.