CVE-2022-41849

What it actually does

Race condition between ufx_ops_open and ufx_usb_disconnect in the smscufx USB framebuffer driver causes use-after-free when a device is removed during open().

Why it matters to the business

Low-probability denial-of-service crashes on Linux systems using the affected USB video device; physical-access requirement and long-since-published fix limit operational exposure across the ecosystem.

How an attack unfolds

An attacker with physical access connects the USB device, triggers an open() call in the driver, then removes the device to win the race between the open and disconnect paths and trigger the use-after-free.

How to fix it

Upgrade the Linux kernel to a version containing commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel source contains commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c; confirm absence of the race by code review or by attempting concurrent open/disconnect operations on patched versus unpatched builds.

Typical attack path

1. Obtain brief physical access to the target system
2. Insert the supported USB device
3. Cause the driver open() path to execute
4. Remove the USB device during the open window
5. Trigger kernel panic or memory corruption via the resulting use-after-free

How to detect it

Review kernel logs and USB event traces for smscufx disconnect events occurring during open operations; look for use-after-free oops or panic messages referencing ufx_usb_disconnect.

What your security team should do

• Apply the kernel update containing commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c to all affected systems
• Restrict physical access to systems that expose the vulnerable USB driver
• Monitor kernel logs for smscufx-related oops or use-after-free warnings until patches are deployed