What’s Vulnerable › Vulnerabilities

CVE-2022-50028: gadgetfs: ep_io - wait until IRQ finishes

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: gadgetfs: ep_io - wait until IRQ finishes after usb_ep_queue() if wait_for_completion_interruptible() is interrupted we need to wait until IRQ gets finished. Otherwise complete() from epio_complete() can corrupt stack.

Affected products

• Linux kernel: before 4.9.326; from 4.10 before 4.14.291; from 4.15 before 4.19.256; from 4.20 before 5.4.211; from 5.5 before 5.10.138; from 5.11 before 5.15.63 — fixed in 4.14.291, 4.19.256, 4.9.326, 5.10.138, 5.15.63, 5.19.4

How to fix

Upgrade to a fixed version: Linux kernel 4.14.291, 4.19.256, 4.9.326, 5.10.138. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/04cb742d4d8f30dc2e83b46ac317eec09191c68e
• https://git.kernel.org/stable/c/118d967ce00a3d128bf731b35e4e2cb0facf5f00
• https://git.kernel.org/stable/c/2b06d5d97c0e067108a122986767731d40742138
• https://git.kernel.org/stable/c/67a4874461422e633236a0286a01b483cd647113
• https://git.kernel.org/stable/c/77040efe59a141286d090c8a0d37c65a355a1832
• https://git.kernel.org/stable/c/94aadba8d000d5de56af4ce8da3f334f21bf7a79
• https://git.kernel.org/stable/c/9ac14f973cb91f0c01776517e6d50981f32b8038
• https://git.kernel.org/stable/c/ca06b4cde54f8ec8be3aa53fd339bd56e62c12b3

Get alerted when CVE-2022-50028 or the next vulnerability affects your stack