https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:13:16 +0000 https://cve.radiocsirt.org/vuln/cve-2022-49755 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait</p> <p>While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind.</p> <p>Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &amp;ffs-&gt;ev.waitq.lock. However, the functionfs_unbind isn&#39;t bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.</p> <p>Fix this by making a serialized execution between the two functions using a mutex_lock(ffs-&gt;mutex).</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait</p> <p>While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind.</p> <p>Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &amp;ffs-&gt;ev.waitq.lock. However, the functionfs_unbind isn&#39;t bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.</p> <p>Fix this by making a serialized execution between the two functions using a mutex_lock(ffs-&gt;mutex).</p> https://cve.radiocsirt.org/vuln/cve-2022-49755