PT-2025-8332 · Linux+5 · Linux Kernel+5

Wesley Cheng · Published 2022-01-01 · Updated 2026-03-14 · CVE-2022-49398

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved. The issue occurs when the list for each entry safe() macro is used with gadget giveback, allowing other routines to execute while items are being removed from the cancelled list. This can lead to a situation where a request is referenced after it has been removed, causing a panic when list debug is enabled. The vulnerability is related to the dwc3 gadget ep cleanup cancelled requests() function and the dwc3 gadget giveback() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

ALSA-2025_16880

BDU:2026-03751

CESA-2022_7683

CVE-2022-49398

OPENSUSE-SU-2025_1263-1

RHSA-2022:7683

RHSA-2022:8267

RHSA-2022_7683

RHSA-2022_8267

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1194-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1263-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1263-1

Affected Products

Astra Linux

Centos

Debian

Linux Kernel

Red Hat

Suse

References · 1349

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49398.json · Exploit
• https://git.kernel.org/stable/c/1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a · Patch
• https://git.kernel.org/stable/c/2424307cdf421ac72075a1384eae4e4199ab6457 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49398 · Vendor Advisory
• https://git.kernel.org/stable/c/26a7e6832afe9d9a991cfd9015177f083cf959cc · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49398 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03751 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-49398 · Security Note
• https://git.kernel.org/stable/c/bf594d1d0c1d7b895954018043536ffd327844f9 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1194-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49398 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory