CVE-2022-48838

What it actually does

Race condition allows gadget core to NULL udc->dev.driver between a check and dereference in dev_uevent, resulting in use-after-free read in the driver core.

Why it matters to the business

Kernel crashes or denial of service on affected Linux systems when USB gadget functionality is exercised under concurrent uevent operations; high prevalence in embedded and Android kernels increases exposure for device fleets.

How an attack unfolds

An attacker with local access or control over USB gadget setup triggers concurrent device uevent generation and gadget driver unbind operations; the window between the dev->driver test and its dereference in dev_uevent leads to the freed pointer access, manifesting as KASAN-detected use-after-free.

How to fix it

Apply the upstream fix in commit 4325124dde6726267813c736fee61226f1d38f0b or later; rebuild and deploy updated kernel images to all affected systems; disable USB gadget support where not required.

How to confirm the fix worked

Confirm kernel source contains the commit removing assignments to udc->dev.driver; run syzbot-style reproducers or concurrent uevent/gadget unbind tests under KASAN to verify absence of the use-after-free; check /proc/version or module signatures post-upgrade.

Typical attack path

1. Obtain local or gadget-context privileges on the target system
2. Register and unregister a USB gadget driver while triggering uevent reads on the UDC device
3. Exploit the narrow race window to cause dev_uevent to dereference a now-NULL driver pointer
4. Trigger kernel oops or memory corruption leading to denial of service

How to detect it

Search kernel logs for KASAN use-after-free reports referencing dev_uevent in drivers/base/core.c; monitor for oops or panic traces involving udc device driver dereferences during gadget unbind; review audit logs for concurrent USB gadget attach/detach and udev events.

• BUG: KASAN: use-after-free in dev_uevent
• Read of size 8 at addr .* by task udevd
• dev_uevent+0x712/0x780 drivers/base/core.c:2320

What your security team should do

• Prioritize kernel upgrades containing commit 4325124dde6726267813c736fee61226f1d38f0b on all Linux and Android devices
• Audit systems for custom USB gadget drivers and minimize their use
• Enable KASAN or similar memory safety tooling in test environments to catch similar races
• Monitor for kernel oops involving dev_uevent and core.c