CVE-2022-49686
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49686
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49686.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-49686
- Related
- Published
- 2025-02-26T07:01:43Z
- Modified
- 2025-02-26T07:01:43Z
- Downstream
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: fix list double add in uvcgvideopump
A panic can occur if the endpoint becomes disabled and the uvcgvideopump adds the request back to the reqfree list after it has already been queued to the endpoint. The endpoint complete will add the request back to the reqfree list. Invalidate the local request handle once it's been queued.
<6>[ 246.796704][T13726] configfs-gadget gadget: uvc: uvcfunctionsetalt(1, 0) <3>[ 246.797078][ T26] listadd double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90. <6>[ 246.797213][ T26] ------------[ cut here ]------------ <2>[ 246.797224][ T26] kernel BUG at lib/listdebug.c:31! <6>[ 246.807073][ T26] Call trace: <6>[ 246.807180][ T26] uvcgvideopump+0x364/0x38c <6>[ 246.807366][ T26] processonework+0x2a4/0x544 <6>[ 246.807394][ T26] workerthread+0x350/0x784 <6>[ 246.807442][ T26] kthread+0x2ac/0x320
- References
Affected packages
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source