CVE-2022-48836

What it actually does

The aiptek USB tablet driver performed only a count check on endpoints instead of validating endpoint type before calling usb_submit_urb, allowing submission of an URB to a mismatched pipe type and triggering a kernel warning or crash.

Why it matters to the business

Systems using affected aiptek USB input hardware may experience kernel warnings, device unavailability, or local denial of service when the driver is loaded or opened, with limited exploit maturity reducing immediate widespread risk despite the kernel-wide impact.

How an attack unfolds

An attacker with local access attaches a malicious or malformed USB device presenting an aiptek-compatible interface; when the input subsystem opens the device, the driver submits an URB to an incorrect endpoint type, causing the USB core to log a bogus pipe warning and potentially crash the worker thread.

How to fix it

Update the Linux kernel to the fixed commit 57277a8b5d881e02051ba9d7f6cb3f915c229821 or later stable releases that incorporate the usb_find_common_endpoints helper check; disable the aiptek module if the hardware is not required.

How to confirm the fix worked

Confirm the running kernel contains commit 57277a8b5d881e02051ba9d7f6cb3f915c229821; test by attaching an aiptek device and verifying absence of the 'BOGUS urb xfer' warning in dmesg.

Typical attack path

1. Gain local user access on a Linux system with the aiptek driver enabled
2. Attach or emulate a USB device that triggers aiptek_open
3. Trigger input_open_device which calls into the flawed endpoint handling
4. Observe kernel warning or crash in usb_submit_urb

How to detect it

Search kernel logs for the string 'BOGUS urb xfer, pipe' combined with aiptek_open stack traces; inspect USB device attachment events preceding the warning in dmesg or journalctl.

• BOGUS urb xfer, pipe 1 != type 3
• aiptek_open+0xd5/0x130
• WARNING: CPU.*usb_submit_urb

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on systems exposing USB input drivers
• Audit kernel configurations to blacklist unused tablet drivers such as aiptek
• Monitor for future backports to long-term supported kernels