CVE-2022-50514

5.5 MEDIUM
Denial of Service

📋 TL;DR

This CVE describes a reference count leak vulnerability in the Linux kernel's USB gadget HID function driver. When the driver fails to allocate memory for a report descriptor, it doesn't properly decrement a reference counter, potentially causing resource exhaustion. This affects systems using USB gadget functionality, particularly embedded devices and systems with USB peripheral capabilities.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific affected versions not explicitly stated in CVE description; check kernel commit history for exact ranges.
Operating Systems: Linux distributions using vulnerable kernel versions
Default Config Vulnerable: ✅ No
Notes: Requires USB gadget functionality enabled and HID gadget usage. Not all systems have this enabled by default.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Resource exhaustion leading to denial of service, potentially causing kernel instability or system crashes if repeatedly triggered.

🟠

Likely Case

Local denial of service requiring physical USB device connection or USB gadget mode activation by privileged user.

🟢

If Mitigated

Minimal impact with proper access controls and monitoring in place.

🌐 Internet-Facing: LOW - Requires local USB device connection or USB gadget mode activation.
🏢 Internal Only: MEDIUM - Could be exploited by users with physical access or USB gadget configuration privileges.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires triggering the specific error path during USB HID gadget initialization.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing fixes from the referenced git commits

Vendor Advisory: https://git.kernel.org/stable/c/216437dd64fce36791a3b6cc8f8013df36856958

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable USB gadget HID function

linux

Prevent exploitation by disabling the vulnerable USB gadget HID functionality

modprobe -r g_hid
echo 'blacklist g_hid' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

  • Restrict physical USB device access to trusted users only
  • Disable USB gadget functionality if not required for system operation

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if USB gadget HID module is loaded: lsmod | grep g_hid

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated beyond vulnerable commits and test USB gadget functionality

📡 Detection & Monitoring

Log Indicators:

  • Kernel oops messages related to USB gadget
  • Memory allocation failures in kernel logs

Network Indicators:

  • Not applicable - local vulnerability

SIEM Query:

Not applicable for network detection

📊 Metadata

CVE ID: CVE-2022-50514
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: October 7, 2025
Last Updated: February 5, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON