VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 22, 2025· Updated Apr 15, 2026

CVE-2022-50568

CVE-2022-50568

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_hid: fix f_hidg lifetime vs cdev

The embedded struct cdev does not have its lifetime correctly tied to the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN is held open while the gadget is deleted.

This can readily be replicated with libusbgx's example programs (for conciseness - operating directly via configfs is equivalent):

gadget-hid exec 3<> /dev/hidg0 gadget-vid-pid-remove exec 3<&-

Pull the existing device up in to struct f_hidg and make use of the cdev_device_{add,del}() helpers. This changes the lifetime of the device object to match struct f_hidg, but note that it is still added and deleted at the same time.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

85

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.