CVE-2022-48822

What it actually does

Race condition in Linux kernel usb f_fs driver between ffs_func_eps_disable and ffs_epfile_release allows use-after-free on epfiles structures and read buffers after concurrent composition switch and userspace release.

Why it matters to the business

Kernel instability or potential code execution on systems using USB gadget/FFS functionality, affecting device drivers and embedded/Android-derived deployments with many downstream package dependents; low urgency given age and lack of known exploitation.

How an attack unfolds

An attacker with local access triggers concurrent ffs_func_eps_disable during composition changes and ffs_epfile_release from userspace, causing the driver to dereference a freed epfile after ffs_data_closed destroys it, leading to use-after-free; context includes Android kernel RCE scenarios.

How to fix it

Upgrade affected kernels to fixed versions: Debian 11/12/13 to 5.10.103-1 or 5.16.7-1, mainline Linux to 4.4.302 or later, and Ubuntu 20.04 LTS packages (linux-aws-5.15 etc.) to the listed 5.15.0-* or 5.4.0-* revisions; disable USB FFS if unused.

How to confirm the fix worked

Verify running kernel version against fixed package lists per distribution; inspect /proc/config.gz or build logs for usb f_fs patches; test composition switch and epfile close concurrency under load.

Typical attack path

1. Obtain local access or control a process interacting with USB function filesystem endpoints
2. Trigger USB composition switch to invoke ffs_func_eps_disable while simultaneously closing the last epfile from userspace
3. Race allows ffs_epfile_release to free buffers and null epfiles before spinlock acquisition in disable path
4. Stale epfile reference leads to double-free or use-after-free on read buffer

How to detect it

Review kernel logs for use-after-free warnings or oops traces mentioning ffs_func_eps_disable, ffs_epfile_release, or epfiles; correlate with USB gadget events and process terminations on systems using functionfs.

What your security team should do

• Apply kernel updates to fixed versions immediately on exposed systems
• Audit USB gadget and FFS usage and restrict to trusted processes
• Monitor for kernel oops/panic logs involving f_fs or epfiles
• Harden local access controls to reduce race trigger surface