CVE-2022-49501 (GCVE-0-2022-49501)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-05-11 19:01
VLAI
Title
usbnet: Run unregister_netdev() before unbind() again
Summary
In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregister_netdev() before unbind() again Commit 2c9d6c2b871d ("usbnet: run unbind() before unregister_netdev()") sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessary to address the issue: https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/ So the commit was not necessary. The commit made binding and unbinding of USB Ethernet asymmetrical: Before, usbnet_probe() first invoked the ->bind() callback and then register_netdev(). usbnet_disconnect() mirrored that by first invoking unregister_netdev() and then ->unbind(). Since the commit, the order in usbnet_disconnect() is reversed and no longer mirrors usbnet_probe(). One consequence is that a PHY disconnected (and stopped) in ->unbind() is afterwards stopped once more by unregister_netdev() as it closes the netdev before unregistering. That necessitates a contortion in ->stop() because the PHY may only be stopped if it hasn't already been disconnected. Reverting the commit allows making the call to phy_stop() unconditional in ->stop().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:15 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c , < 6d5deb242874d924beccf7eb3cef04c1c3b0da79 (git)
Affected: 2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c , < fbda837107f9bd4ec658d2aa88c6856dba606f06 (git)
Affected: 2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c , < 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509 (git)
Affected: 2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c , < d1408f6b4dd78fb1b9e26bcf64477984e5f85409 (git)
Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.46 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49501",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:15:41.764586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:32.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/asix_devices.c",
            "drivers/net/usb/smsc95xx.c",
            "drivers/net/usb/usbnet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d5deb242874d924beccf7eb3cef04c1c3b0da79",
              "status": "affected",
              "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
              "versionType": "git"
            },
            {
              "lessThan": "fbda837107f9bd4ec658d2aa88c6856dba606f06",
              "status": "affected",
              "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
              "versionType": "git"
            },
            {
              "lessThan": "969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509",
              "status": "affected",
              "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
              "versionType": "git"
            },
            {
              "lessThan": "d1408f6b4dd78fb1b9e26bcf64477984e5f85409",
              "status": "affected",
              "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/asix_devices.c",
            "drivers/net/usb/smsc95xx.c",
            "drivers/net/usb/usbnet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Run unregister_netdev() before unbind() again\n\nCommit 2c9d6c2b871d (\"usbnet: run unbind() before unregister_netdev()\")\nsought to fix a use-after-free on disconnect of USB Ethernet adapters.\n\nIt turns out that a different fix is necessary to address the issue:\nhttps://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/\n\nSo the commit was not necessary.\n\nThe commit made binding and unbinding of USB Ethernet asymmetrical:\nBefore, usbnet_probe() first invoked the -\u003ebind() callback and then\nregister_netdev().  usbnet_disconnect() mirrored that by first invoking\nunregister_netdev() and then -\u003eunbind().\n\nSince the commit, the order in usbnet_disconnect() is reversed and no\nlonger mirrors usbnet_probe().\n\nOne consequence is that a PHY disconnected (and stopped) in -\u003eunbind()\nis afterwards stopped once more by unregister_netdev() as it closes the\nnetdev before unregistering.  That necessitates a contortion in -\u003estop()\nbecause the PHY may only be stopped if it hasn\u0027t already been\ndisconnected.\n\nReverting the commit allows making the call to phy_stop() unconditional\nin -\u003estop()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:01:08.248Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d5deb242874d924beccf7eb3cef04c1c3b0da79"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbda837107f9bd4ec658d2aa88c6856dba606f06"
        },
        {
          "url": "https://git.kernel.org/stable/c/969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1408f6b4dd78fb1b9e26bcf64477984e5f85409"
        }
      ],
      "title": "usbnet: Run unregister_netdev() before unbind() again",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49501",
    "datePublished": "2025-02-26T02:13:34.885Z",
    "dateReserved": "2025-02-26T02:08:31.586Z",
    "dateUpdated": "2026-05-11T19:01:08.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49501",
      "date": "2026-10-04",
      "epss": "0.00267",
      "percentile": "0.17142"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/usb/asix_devices.c",
                  "drivers/net/usb/smsc95xx.c",
                  "drivers/net/usb/usbnet.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6d5deb242874d924beccf7eb3cef04c1c3b0da79",
                    "status": "affected",
                    "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fbda837107f9bd4ec658d2aa88c6856dba606f06",
                    "status": "affected",
                    "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509",
                    "status": "affected",
                    "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d1408f6b4dd78fb1b9e26bcf64477984e5f85409",
                    "status": "affected",
                    "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/usb/asix_devices.c",
                  "drivers/net/usb/smsc95xx.c",
                  "drivers/net/usb/usbnet.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "40E62665-0BA6-440F-83E8-6F8EC2D3C9DF",
                    "versionEndExcluding": "5.15.46",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15E2DD33-2255-4B76-9C15-04FF8CBAB252",
                    "versionEndExcluding": "5.17.14",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2",
                    "versionEndExcluding": "5.18.3",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Run unregister_netdev() before unbind() again\n\nCommit 2c9d6c2b871d (\"usbnet: run unbind() before unregister_netdev()\")\nsought to fix a use-after-free on disconnect of USB Ethernet adapters.\n\nIt turns out that a different fix is necessary to address the issue:\nhttps://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/\n\nSo the commit was not necessary.\n\nThe commit made binding and unbinding of USB Ethernet asymmetrical:\nBefore, usbnet_probe() first invoked the -\u003ebind() callback and then\nregister_netdev().  usbnet_disconnect() mirrored that by first invoking\nunregister_netdev() and then -\u003eunbind().\n\nSince the commit, the order in usbnet_disconnect() is reversed and no\nlonger mirrors usbnet_probe().\n\nOne consequence is that a PHY disconnected (and stopped) in -\u003eunbind()\nis afterwards stopped once more by unregister_netdev() as it closes the\nnetdev before unregistering.  That necessitates a contortion in -\u003estop()\nbecause the PHY may only be stopped if it hasn\u0027t already been\ndisconnected.\n\nReverting the commit allows making the call to phy_stop() unconditional\nin -\u003estop()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usbnet: Ejecutar unregister_netdev() antes unbind() de nuevo El commit 2c9d6c2b871d (\"usbnet: run unbind() antes unregister_netdev()\") buscaba corregir un uso despu\u00e9s de liberaci\u00f3n (use-after-free) al desconectar los adaptadores USB Ethernet. Resulta que es necesaria una correcci\u00f3n diferente para abordar el problema: https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/ Por lo tanto, el commit no era necesario. El commit hizo que la vinculaci\u00f3n y desvinculaci\u00f3n de USB Ethernet fuera asim\u00e9trica: antes, usbnet_probe() primero invocaba la devoluci\u00f3n de llamada -\u0026amp;gtbind() y luego register_netdev(). usbnet_disconnect() reflej\u00f3 eso al invocar primero unregister_netdev() y luego -\u0026amp;gtunbind(). Desde el commit, el orden en usbnet_disconnect() se invierte y ya no refleja usbnet_probe(). Una consecuencia es que un PHY desconectado (y detenido) en -\u0026amp;gtunbind() se detiene luego una vez m\u00e1s por unregister_netdev() ya que cierra el netdev antes de anular el registro. Eso requiere una contorsi\u00f3n en -\u0026amp;gtstop() porque el PHY solo se puede detener si no se ha desconectado ya. Revertir el commit permite hacer que la llamada a phy_stop() sea incondicional en -\u0026amp;gtstop().\n"
          }
        ],
        "id": "CVE-2022-49501",
        "lastModified": "2026-06-17T05:18:15.377",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49501",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:15:41.764586Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-26T07:01:26.257",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6d5deb242874d924beccf7eb3cef04c1c3b0da79"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d1408f6b4dd78fb1b9e26bcf64477984e5f85409"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fbda837107f9bd4ec658d2aa88c6856dba606f06"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49501",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-27T18:15:41.764586Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-27T18:15:43.221Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/usb/asix_devices.c",
                "drivers/net/usb/smsc95xx.c",
                "drivers/net/usb/usbnet.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "6d5deb242874d924beccf7eb3cef04c1c3b0da79",
                  "status": "affected",
                  "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
                  "versionType": "git"
                },
                {
                  "lessThan": "fbda837107f9bd4ec658d2aa88c6856dba606f06",
                  "status": "affected",
                  "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
                  "versionType": "git"
                },
                {
                  "lessThan": "969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509",
                  "status": "affected",
                  "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
                  "versionType": "git"
                },
                {
                  "lessThan": "d1408f6b4dd78fb1b9e26bcf64477984e5f85409",
                  "status": "affected",
                  "version": "2c9d6c2b871d5841ce26ede3e81fd37e2e33c42c",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/usb/asix_devices.c",
                "drivers/net/usb/smsc95xx.c",
                "drivers/net/usb/usbnet.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.14"
                },
                {
                  "lessThan": "5.14",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.46",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.17.*",
                  "status": "unaffected",
                  "version": "5.17.14",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.18.*",
                  "status": "unaffected",
                  "version": "5.18.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.19",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.46",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17.14",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18.3",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Run unregister_netdev() before unbind() again\n\nCommit 2c9d6c2b871d (\"usbnet: run unbind() before unregister_netdev()\")\nsought to fix a use-after-free on disconnect of USB Ethernet adapters.\n\nIt turns out that a different fix is necessary to address the issue:\nhttps://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/\n\nSo the commit was not necessary.\n\nThe commit made binding and unbinding of USB Ethernet asymmetrical:\nBefore, usbnet_probe() first invoked the -\u003ebind() callback and then\nregister_netdev().  usbnet_disconnect() mirrored that by first invoking\nunregister_netdev() and then -\u003eunbind().\n\nSince the commit, the order in usbnet_disconnect() is reversed and no\nlonger mirrors usbnet_probe().\n\nOne consequence is that a PHY disconnected (and stopped) in -\u003eunbind()\nis afterwards stopped once more by unregister_netdev() as it closes the\nnetdev before unregistering.  That necessitates a contortion in -\u003estop()\nbecause the PHY may only be stopped if it hasn\u0027t already been\ndisconnected.\n\nReverting the commit allows making the call to phy_stop() unconditional\nin -\u003estop()."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T19:01:08.248Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/6d5deb242874d924beccf7eb3cef04c1c3b0da79"
            },
            {
              "url": "https://git.kernel.org/stable/c/fbda837107f9bd4ec658d2aa88c6856dba606f06"
            },
            {
              "url": "https://git.kernel.org/stable/c/969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509"
            },
            {
              "url": "https://git.kernel.org/stable/c/d1408f6b4dd78fb1b9e26bcf64477984e5f85409"
            }
          ],
          "title": "usbnet: Run unregister_netdev() before unbind() again",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49501",
        "datePublished": "2025-02-26T02:13:34.885Z",
        "dateReserved": "2025-02-26T02:08:31.586Z",
        "dateUpdated": "2026-05-11T19:01:08.248Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.