CVE-2022-48869 — USB: gadgetfs: Fix race between mounting and unmounting

Back Back to CVE browser

MEDIUM

USB: gadgetfs: Fix race between mounting and unmounting

Published Aug 21, 2024

4.7

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() can race with gadgetfs_kill_sb(), causing the latter to deallocate the_device while the former is using it. The output from KASAN says, in part:

BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline] BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline] BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline] BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689

CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> ... atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] __refcount_sub_and_test include/linux/refcount.h:272 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 vfs_get_super fs/super.c:1190 [inline] get_tree_single+0xd0/0x160 fs/super.c:1207 vfs_get_tree+0x88/0x270 fs/super.c:1531 vfs_fsconfig_locked fs/fsopen.c:232 [inline]

The simplest solution is to ensure that gadgetfs_fill_super() and gadgetfs_kill_sb() are serialized by making them both acquire a new mutex.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  e5d82a7360d1
  Status
  affected
  Constraints
  <616fd34d0170
- Version
  e5d82a7360d1
  Status
  affected
  Constraints
  <856e4b5e53f2
- Version
  e5d82a7360d1
  Status
  affected
  Constraints
  <9a39f4626b36
- Version
  e5d82a7360d1
  Status
  affected
  Constraints
  <a2e075f40122
- Version
  e5d82a7360d1
  Status
  affected
  Constraints
  <d18dcfe9860e
Vendor Linux Product Linux Default
affected
- Version
  5.3
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.3
- Version
  5.10.165
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.90
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.4.230
  Status
  unaffected
  Constraints
  <=5.4.*
- Version
  6.1.8
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.2
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
e5d82a7360d1	affected	<616fd34d0170
e5d82a7360d1	affected	<856e4b5e53f2
e5d82a7360d1	affected	<9a39f4626b36
e5d82a7360d1	affected	<a2e075f40122
e5d82a7360d1	affected	<d18dcfe9860e

Linux

affected

Version	Status	Constraints
5.3	affected	-
0	unaffected	<5.3
5.10.165	unaffected	<=5.10.*
5.15.90	unaffected	<=5.15.*
5.4.230	unaffected	<=5.4.*
6.1.8	unaffected	<=6.1.*
6.2	unaffected	<=*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

Red Hat statement

Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

0.23% 0.00232

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00232

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.23% (0.00232)	12.82th	v5 (v2026.06.15)
Jun 15, 2026	0.23% (0.00232)	13.84th	v5 (v2026.06.15)
Mar 17, 2025	0.03% (0.00029)	5.20th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Aug 22, 2024	0.04% (0.00045)	16.38th	v3 (v2023.03.01)

Weaknesses (1)

CWE-416

Use After Free

References (10)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-48869		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2306390		Issue Tracking
https://git.kernel.org/stable/c/616fd34d017000ecf9097368b13d8a266f4920b3		Patch
https://git.kernel.org/stable/c/856e4b5e53f21edbd15d275dde62228dd94fb2b4		Patch
https://git.kernel.org/stable/c/9a39f4626b361ee7aa10fd990401c37ec3b466ae		Patch
https://git.kernel.org/stable/c/a2e075f40122d8daf587db126c562a67abd69cf9		Patch
https://git.kernel.org/stable/c/d18dcfe9860e842f394e37ba01ca9440ab2178f4		Patch
https://lore.kernel.org/linux-cve-announce/2024082105-CVE-2022-48869-bfe9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-48869
https://www.cve.org/CVERecord?id=CVE-2022-48869