What’s Vulnerable › Vulnerabilities

CVE-2022-50132: usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() If 'ep' is NULL, result of ep_to_cdns3_ep(ep) is invalid pointer and its dereference with priv_ep->cdns3_dev may cause panic. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected products

• Linux kernel: from 5.4 before 5.10.137; from 5.11 before 5.15.61; from 5.16 before 5.18.18; from 5.19 before 5.19.2 — fixed in 5.10.137, 5.15.61, 5.18.18, 5.19.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.137, 5.15.61, 5.18.18, 5.19.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/7af83bb516d7aa4f96835288e4aeda21d7aa2a17
• https://git.kernel.org/stable/c/bfa0201468587072454dba7933e4a4a7be44467a
• https://git.kernel.org/stable/c/c3ffc9c4ca44bfe9562166793d133e1fb0630ea6
• https://git.kernel.org/stable/c/d342203df9f2d0851b4acd9ed577d73d10eade77
• https://git.kernel.org/stable/c/eb82c0382285ee17a9966aaab27b8becb08eb1ac

Get alerted when CVE-2022-50132 or the next vulnerability affects your stack