{"cve":"CVE-2022-49398","nvd":{"published":"2025-02-26T07:01:16.377","modified":"2026-06-17T05:17:56.197","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback\n\nThe list_for_each_entry_safe() macro saves the current item (n) and\nthe item after (n+1), so that n can be safely removed without\ncorrupting the list.  However, when traversing the list and removing\nitems using gadget giveback, the DWC3 lock is briefly released,\nallowing other routines to execute.  There is a situation where, while\nitems are being removed from the cancelled_list using\ndwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable\nroutine is running in parallel (due to UDC unbind).  As the cleanup\nroutine removes n, and the pullup disable removes n+1, once the\ncleanup retakes the DWC3 lock, it references a request who was already\nremoved/handled.  With list debug enabled, this leads to a panic.\nEnsure all instances of the macro are replaced where gadget giveback\nis used.\n\nExample call stack:\n\nThread#1:\n__dwc3_gadget_ep_set_halt() - CLEAR HALT\n  -> dwc3_gadget_ep_cleanup_cancelled_requests()\n    ->list_for_each_entry_safe()\n    ->dwc3_gadget_giveback(n)\n      ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list]\n      ->spin_unlock\n      ->Thread#2 executes\n      ...\n    ->dwc3_gadget_giveback(n+1)\n      ->Already removed!\n\nThread#2:\ndwc3_gadget_pullup()\n  ->waiting for dwc3 spin_lock\n  ...\n  ->Thread#1 released lock\n  ->dwc3_stop_active_transfers()\n    ->dwc3_remove_requests()\n      ->fetches n+1 item from cancelled_list (n removed by Thread#1)\n      ->dwc3_gadget_giveback()\n        ->dwc3_gadget_del_and_unmap_request()- n+1 deleted[cancelled_list]\n        ->spin_unlock","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a","https://git.kernel.org/stable/c/2424307cdf421ac72075a1384eae4e4199ab6457","https://git.kernel.org/stable/c/26a7e6832afe9d9a991cfd9015177f083cf959cc","https://git.kernel.org/stable/c/bf594d1d0c1d7b895954018043536ffd327844f9"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2022-49398","score":0.00268,"percentile":0.19038,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}