{
  "cveId": "CVE-2022-48926",
  "url": "https://patchblox.com/security/cve/CVE-2022-48926",
  "summary": "CVE-2022-48926 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48926, released August 22, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: rndis: add spinlock for rndis respo...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: rndis: add spinlock for rndis response list  There\u0027s no lock for rndis response list. It could cause list corruption if there\u0027re two different list_add at the same time like below. It\u0027s better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list.  [  361.894299] [1:   irq/191-dwc3:16979] list_add corruption. next-\u003Eprev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0).  [  361.904380] [1:   irq/191-dwc3:16979] Call trace: [  361.904391] [1:   irq/191-dwc3:16979]  __list_add_valid\u002B0x74/0x90 [  361.904401] [1:   irq/191-dwc3:16979]  rndis_msg_parser\u002B0x168/0x8c0 [  361.904409] [1:   irq/191-dwc3:16979]  rndis_command_complete\u002B0x24/0x84 [  361.904417] [1:   irq/191-dwc3:16979]  usb_gadget_giveback_request\u002B0x20/0xe4 [  361.904426] [1:   irq/191-dwc3:16979]  dwc3_gadget_giveback\u002B0x44/0x60 [  361.904434] [1:   irq/191-dwc3:16979]  dwc3_ep0_complete_data\u002B0x1e8/0x3a0 [  361.904442] [1:   irq/191-dwc3:16979]  dwc3_ep0_interrupt\u002B0x29c/0x3dc [  361.904450] [1:   irq/191-dwc3:16979]  dwc3_process_event_entry\u002B0x78/0x6cc [  361.904457] [1:   irq/191-dwc3:16979]  dwc3_process_event_buf\u002B0xa0/0x1ec [  361.904465] [1:   irq/191-dwc3:16979]  dwc3_thread_interrupt\u002B0x34/0x5c",
  "published": "2024-08-22T04:15:15Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00219,
  "epssPercentile": 0.12455,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.16.12-1",
      "fix": "DEBIAN-CVE-2022-48926",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48926",
      "released": "2024-08-22T04:15:15Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.16.12-1",
      "fix": "DEBIAN-CVE-2022-48926",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48926",
      "released": "2024-08-22T04:15:15Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.16.12-1",
      "fix": "DEBIAN-CVE-2022-48926",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48926",
      "released": "2024-08-22T04:15:15Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}