CVE-2022-49398

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely removed without corrupting the list. However, when traversing the list and removing items using gadget giveback, the DWC3 lock is briefly released, allowing other routines to execute. There is a situation where, while items are being removed from the cancelled_list using dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable routine is running in parallel (due to UDC unbind). As the cleanup routine removes n, and the pullup disable removes n+1, once the cleanup retakes the DWC3 lock, it references a request who was already removed/handled. With list debug enabled, this leads to a panic. Ensure all instances of the macro are replaced where gadget giveback is used. Example call stack: Thread#1: __dwc3_gadget_ep_set_halt() - CLEAR HALT -> dwc3_gadget_ep_cleanup_cancelled_requests() ->list_for_each_entry_safe() ->dwc3_gadget_giveback(n) ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list] ->spin_unlock ->Thread#2 executes ... ->dwc3_gadget_giveback(n+1) ->Already removed! Thread#2: dwc3_gadget_pullup() ->waiting for dwc3 spin_lock ... ->Thread#1 released lock ->dwc3_stop_active_transfers() ->dwc3_remove_requests() ->fetches n+1 item from cancelled_list (n removed by Thread#1) ->dwc3_gadget_giveback() ->dwc3_gadget_del_and_unmap_request()- n+1 deleted[cancelled_list] ->spin_unlock

• https://git.kernel.org/stable/c/1c6e5dc3b639c96e6839a8d1b8e951923fdfd34aPatch
• https://git.kernel.org/stable/c/2424307cdf421ac72075a1384eae4e4199ab6457Patch
• https://git.kernel.org/stable/c/26a7e6832afe9d9a991cfd9015177f083cf959ccPatch
• https://git.kernel.org/stable/c/bf594d1d0c1d7b895954018043536ffd327844f9Patch

Published

Feb 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-49392In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49393In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49394In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49395In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2022-49396In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49397In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49399In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-4940The WCFM Membership plugin for WordPress is vulnerable to un…6.5
• CVE-2022-49400In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49401In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2022-49402In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49403In the Linux kernel, the following vulnerability has been re…5.5