Not yet scoredPublished Oct 22, 2025

CVE-2022-50568usb: gadget: f_hid: fix f_hidg lifetime vs cdev

Updated under an hour ago (Oct 27, 2026, 7:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: fix f_hidg lifetime vs cdev The embedded struct cdev does not have its lifetime correctly tied to the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN is held open while the gadget is deleted. This can readily be replicated with libusbgx's example programs (for conciseness - operating directly via configfs is equivalent): gadget-hid exec 3<> /dev/hidg0 gadget-vid-pid-remove exec 3<&- Pull the existing device up in to struct f_hidg and make use of the cdev_device_{add,del}() helpers. This changes the lifetime of the device object to match struct f_hidg, but note that it is still added and deleted at the same time.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	71adf118946957839a13aa4d1094183e05c6c094 builds before 1cd7f156f6389918f760687fbbf133c86da93162; from 71adf118946957839a13aa4d1094183e05c6c094 before c78c87c4e389b62f8892af7f59857447aa6d9797; 71adf118946957839a13aa4d1094183e05c6c094 builds before 1b6a53e447ec3d81623610c8c7ec5082b47dfdce; from 71adf118946957839a13aa4d1094183e05c6c094 before d3136b79705c2e3bba9c76adc5628af0215d798e; 71adf118946957839a13aa4d1094183e05c6c094 builds before 9e4b85d815b14bd4db2deea2a54264a23de8b896; 71adf118946957839a13aa4d1094183e05c6c094 builds before 9e08b7f5fa00e9d550851352bd0d1ba74ccffef2; from 71adf118946957839a13aa4d1094183e05c6c094 before 89ff3dfac604614287ad5aad9370c3f984ea3f4b	CNA record

References

References

https://git.kernel.org/stable/c/1cd7f156f6389918f760687fbbf133c86da93162
https://git.kernel.org/stable/c/c78c87c4e389b62f8892af7f59857447aa6d9797
https://git.kernel.org/stable/c/1b6a53e447ec3d81623610c8c7ec5082b47dfdce
https://git.kernel.org/stable/c/d3136b79705c2e3bba9c76adc5628af0215d798e
https://git.kernel.org/stable/c/9e4b85d815b14bd4db2deea2a54264a23de8b896
https://git.kernel.org/stable/c/9e08b7f5fa00e9d550851352bd0d1ba74ccffef2
https://git.kernel.org/stable/c/89ff3dfac604614287ad5aad9370c3f984ea3f4b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.