{"cve":"CVE-2022-50568","nvd":{"published":"2025-10-22T14:15:41.657","modified":"2026-06-17T05:23:48.470","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_hid: fix f_hidg lifetime vs cdev\n\nThe embedded struct cdev does not have its lifetime correctly tied to\nthe enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN\nis held open while the gadget is deleted.\n\nThis can readily be replicated with libusbgx's example programs (for\nconciseness - operating directly via configfs is equivalent):\n\n\tgadget-hid\n\texec 3<> /dev/hidg0\n\tgadget-vid-pid-remove\n\texec 3<&-\n\nPull the existing device up in to struct f_hidg and make use of the\ncdev_device_{add,del}() helpers.  This changes the lifetime of the\ndevice object to match struct f_hidg, but note that it is still added\nand deleted at the same time.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1b6a53e447ec3d81623610c8c7ec5082b47dfdce","https://git.kernel.org/stable/c/1cd7f156f6389918f760687fbbf133c86da93162","https://git.kernel.org/stable/c/89ff3dfac604614287ad5aad9370c3f984ea3f4b","https://git.kernel.org/stable/c/9e08b7f5fa00e9d550851352bd0d1ba74ccffef2","https://git.kernel.org/stable/c/9e4b85d815b14bd4db2deea2a54264a23de8b896"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2022-50568","score":0.0022,"percentile":0.12545,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}