usbnet: Fix linkwatch use-after-free on disconnect

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2022-50220
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-06-18 11:15:52 UTC
Updated2026-11-05 20:17:27 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock": https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c and smsc75xx.c: * If the drivers receive a link change interrupt immediately before disconnect, they raise EVENT_LINK_RESET in their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent(). * usbnet_deferred_kevent() invokes the driver's ->link_reset() callback, which calls netif_carrier_{on,off}(). * That in turn schedules the work linkwatch_event(). Because usbnet_deferred_kevent() is awaited after unregister_netdev(), netif_carrier_{on,off}() may operate on an unregistered netdev and linkwatch_event() may run after free_netdev(), causing a use-after-free. In 2010, usbnet was changed to only wait for a single instance of usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf ("drivers/net: don't use flush_scheduled_work()"). Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-416

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 d2d6b530d89b0a912148018027386aa049f0a309 git Not specified
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 e2a521a7dcc463c5017b4426ca0804e151faeff7 git Not specified
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 7f77dcbc030c2faa6d8e8a594985eeb34018409e git Not specified
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 8b4588b8b00b299be16a35be67b331d8fdba03f3 git Not specified
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 135199a2edd459d2b123144efcd7f9bcd95128e4 git Not specified
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 635fd8953e4309b54ca6a81bed1d4a87668694f4 git Not specified
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f git Not specified
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 db3b738ae5f726204876f4303c49cfdf4311403f git Not specified
CNA Linux Linux affected 23f333a2bfafba80339315b724808982a9de57d9 a69e617e533edddf3fa3123149900f36e0a6dc74 git Not specified
CNA Linux Linux affected 2.6.38 Not specified
CNA Linux Linux unaffected 2.6.38 semver Not specified
CNA Linux Linux unaffected 4.9.326 4.9.* semver Not specified
CNA Linux Linux unaffected 4.14.291 4.14.* semver Not specified
CNA Linux Linux unaffected 4.19.256 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.211 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.137 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.61 5.15.* semver Not specified
CNA Linux Linux unaffected 5.18.18 5.18.* semver Not specified
CNA Linux Linux unaffected 5.19.2 5.19.* semver Not specified
CNA Linux Linux unaffected 6.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report