# CVE-2022-50704: USB: gadget: Fix use-after-free during usb config switch

> A use-after-free in the Linux kernel USB gadget driver allows local attackers with high privileges to cause a system panic during USB configuration switching.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Dec 2025
- **Updated:** 11 May 2026
- **Also known as:** DEBIAN-CVE-2022-50704, GHSA-mj7r-48h2-hmpx, ROOT-OS-DEBIAN-11-CVE-2022-50704, ROOT-OS-UBUNTU-2204-CVE-2022-50704, UBUNTU-CVE-2022-50704

## What is CVE-2022-50704?

CVE-2022-50704 is an use after free vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: Fix use-after-free during usb config switch

In the process of switching USB config from rndis to other config,
if the hardware does not support the ->pullup callback, or the
hardware encounters a low probability fault, both of them may cause
the ->pullup callback to fail, which will then cause a system panic
(use after free).

The gadget drivers sometimes need to be unloaded regardless of the
hardware's behavior.

Analysis as follows:
=======================================================================
(1) write /config/usb_gadget/g1/UDC "none"

gether_disconnect+0x2c/0x1f8
rndis_disable+0x4c/0x74
composite_disconnect+0x74/0xb0
configfs_composite_disconnect+0x60/0x7c
usb_gadget_disconnect+0x70/0x124
usb_gadget_unregister_driver+0xc8/0x1d8
gadget_dev_desc_UDC_store+0xec/0x1e4

(2) rm /config/usb_gadget/g1/configs/b.1/f1

rndis_deregister+0x28/0x54
rndis_free+0x44/0x7c
usb_put_function+0x14/0x1c
config_usb_cfg_unlink+0xc4/0xe0
configfs_unlink+0x124/0x1c8
vfs_unlink+0x114/0x1dc

(3) rmdir /config/usb_gadget/g1/functions/rndis.gs4

panic+0x1fc/0x3d0
do_page_fault+0xa8/0x46c
do_mem_abort+0x3c/0xac
el1_sync_handler+0x40/0x78
0xffffff801138f880
rndis_close+0x28/0x34
eth_stop+0x74/0x110
dev_close_many+0x48/0x194
rollback_registered_many+0x118/0x814
unregister_netdev+0x20/0x30
gether_cleanup+0x1c/0x38
rndis_attr_release+0xc/0x14
kref_put+0x74/0xb8
configfs_rmdir+0x314/0x374

If gadget->ops->pullup() return an error, function rndis_close() will be
called, then it will causes a use-after-free problem.
=======================================================================

## Which versions are affected by CVE-2022-50704?


## How do I fix CVE-2022-50704?

Apply the vendor's patch.

## Is CVE-2022-50704 being exploited?

There is no known exploitation of CVE-2022-50704 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2022-50704 and fix it if it is affected.

What it is: CVE-2022-50704 is an use after free vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2022-50704 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2022-50704/ (Markdown: https://insights.sbomify.com/CVE-2022-50704/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2022-50704
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-50704
- OSV: https://osv.dev/vulnerability/CVE-2022-50704

---
From sbomify Insights: https://insights.sbomify.com/CVE-2022-50704/
Summaries are generated and may contain mistakes; the official description above is the record.