PT-2025-25862 · Linux+4 · Linux Kernel+4

Published 2022-08-30 · Updated 2025-07-28 · CVE-2022-49936

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.18.0

Description A recursive locking violation was discovered in the Linux kernel's USB storage component. This issue was identified through automatic kernel fuzzing and occurs due to a nested device-reset call. The USB core lacks protection against such nested resets, which can lead to recursive locking violations. The vulnerability is not related to an error in usb-storage but rather a result of a nested device reset attempt.

Recommendations For Linux kernel versions prior to 5.18.0, consider applying a patch that adds a reset in progress flag to prevent nested device resets. As a temporary workaround, avoid performing resets as part of disconnect processing to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-833

Related Identifiers

BDU:2026-02345

CESA-2023_2951

CVE-2022-49936

RHSA-2023:2458

RHSA-2023:2951

RHSA-2023_2458

RHSA-2023_2951

SUSE-SU-2025:02264-1

SUSE-SU-2025:02308-1

SUSE-SU-2025:02320-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:02322-1

SUSE-SU-2025:02334-1

SUSE-SU-2025:02537-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

SUSE-SU-2025_02308-1

SUSE-SU-2025_02334-1

SUSE-SU-2025_02537-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 748

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49936.json · Exploit
• https://bdu.fstec.ru/vul/2026-02345 · Security Note
• https://git.kernel.org/stable/c/c548b99e1c37db6f7df86ecfe9a1f895d6c5966e · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02334-1 · Vendor Advisory
• https://git.kernel.org/stable/c/df1875084898b15cbc42f712e93d7f113ae6271b · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49936 · Vendor Advisory
• https://git.kernel.org/stable/c/1b29498669914c7f9afb619722421418a753d372 · Patch
• https://git.kernel.org/stable/c/d5eb850b3e8836197a38475840725260b9783e94 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49936 · Vendor Advisory
• https://git.kernel.org/stable/c/cc9a12e12808af178c600cc485338bac2e37d2a8 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02308-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02320-1 · Vendor Advisory
• https://git.kernel.org/stable/c/d90419b8b8322b6924f6da9da952647f2dadc21b · Patch
• https://git.kernel.org/stable/c/abe3cfb7a7c8e907b312c7dbd7bf4d142b745aa8 · Patch