CVE-2022-50034: usb: cdns3 fix use-after-free at workaround 2

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-18 · updated 2026-08-15
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac cdns3_wa2_remove_old_request() { ... kfree(priv_req->request.buf); cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ^^^ use after free ... } cdns3_gadget_ep_free_request() free the space pointed by priv_req, but priv_req is used in the following list_del_init(). This patch move list_del_init() before cdns3_gadget_ep_free_request().

Affected products

Linux kernel: from 5.3 before 5.4.211; from 5.5 before 5.10.138; from 5.11 before 5.15.63; from 5.16 before 5.19.4 — fixed in 5.10.138, 5.15.63, 5.19.4, 5.4.211

How to fix

Upgrade to a fixed version: Linux kernel 5.10.138, 5.15.63, 5.19.4, 5.4.211. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-50034 or the next vulnerability affects your stack