CVE-2022-49980 USB: gadget: Fix use-after-free Read in usb_udc_uevent()
A race condition in the Linux kernel USB gadget driver allows a use-after-free, potentially leading to system crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49980?
CVE-2022-49980 is a high-severity use after free vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
USB: gadget: Fix use-after-free Read in usb_udc_uevent()
The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:
--------------------------------------------------------------- BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 Read of size 8 at addr ffff888078ce2050 by task udevd/2968
CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 dev_uevent+0x290/0x770 drivers/base/core.c:2424 ---------------------------------------------------------------
The bug occurs because usb_udc_uevent() dereferences udc->driver but does so without acquiring the udc_lock mutex, which protects this field. If the gadget driver is unbound from the udc concurrently with uevent processing, the driver structure may be accessed after it has been deallocated.
To prevent the race, we make sure that the routine holds the mutex around the racing accesses.
Weakness: CWE-416
Which versions are affected by CVE-2022-49980?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49980?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-49980 being exploited?
There is no known exploitation of CVE-2022-49980 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-70220, DEBIAN-CVE-2022-49980, GHSA-w97r-pxm9-vm23, ROOT-OS-DEBIAN-11-CVE-2022-49980, ROOT-OS-UBUNTU-2204-CVE-2022-49980, UBUNTU-CVE-2022-49980.