Answer in brief
CVE-2022-49755 records a Unknown severity vulnerability in usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2022-49755 records a Unknown severity vulnerability in usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <facf353c9e8d7885b686d9a4b173d4e0af6441d2 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <a8d40942df074f4ebcb9bd3413596d92f323b064 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <6dd9ea05534f323668db94fcc2726c7a84547e78 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <ae8e136bcaae96163b5821984de1036efc9abb1a || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <6aee197b7fbcd61596a78b47d553f2f99111f217 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <6a19da111057f69214b97c62fb0ac59023970850 | facf353c9e8d7885b686d9a4b173d4e0af6441d2, e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4, a8d40942df074f4ebcb9bd3413596d92f323b064, 6dd9ea05534f323668db94fcc2726c7a84547e78, ae8e136bcaae96163b5821984de1036efc9abb1a, 6aee197b7fbcd61596a78b47d553f2f99111f217, 6a19da111057f69214b97c62fb0ac59023970850 |
| Linux/Linuxgeneric | 2.6.35 | Not reported |
Published upstream
Mar 27, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind. Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free. Fix this by making a serialized execution between the two functions using a mutex_lock(ffs->mutex).
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <facf353c9e8d7885b686d9a4b173d4e0af6441d2 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <a8d40942df074f4ebcb9bd3413596d92f323b064 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <6dd9ea05534f323668db94fcc2726c7a84547e78 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <ae8e136bcaae96163b5821984de1036efc9abb1a || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <6aee197b7fbcd61596a78b47d553f2f99111f217 || >=ddf8abd2599491cbad959c700b90ba72a5dce8d0 <6a19da111057f69214b97c62fb0ac59023970850 | facf353c9e8d7885b686d9a4b173d4e0af6441d2, e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4, a8d40942df074f4ebcb9bd3413596d92f323b064, 6dd9ea05534f323668db94fcc2726c7a84547e78, ae8e136bcaae96163b5821984de1036efc9abb1a, 6aee197b7fbcd61596a78b47d553f2f99111f217, 6a19da111057f69214b97c62fb0ac59023970850 |
| Linux/Linuxgeneric | 2.6.35 | Not reported |
Published upstream
Mar 27, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind. Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free. Fix this by making a serialized execution between the two functions using a mutex_lock(ffs->mutex).
Quoted source text, attributed separately from HOL analysis.