CVE-2022-50876

What it actually does

Buffer overflow in musb_gadget rxstate allows out-of-bounds write to request buffer when request length exceeds packet size and buffer is unmapped, due to copying full FIFO contents without length clamping.

Why it matters to the business

Kernel-level memory corruption on affected Linux systems can lead to device crashes, denial of service, or potential privilege escalation when USB gadget functions are used; low exploitability reduces immediate risk but still requires prompt patching on exposed devices.

How an attack unfolds

An attacker would need to trigger musb_gadget_queue with an oversized request under the specific unmapped buffer condition, causing rxstate to overflow the destination buffer during FIFO copy; no public exploits or threat actor campaigns are known.

How to fix it

Update the Linux kernel to include commit 826f84ab04a5cafe484ea9c2c85a3930068e5cb7 (or equivalent) which adds the min_t length check in rxstate; apply the same fix via edb14ff13e9e05394960ba46c3d31d844ff2deac where applicable in downstream trees.

How to confirm the fix worked

Verify the presence of the length check fifocnt = min_t(unsigned, request->length - request->actual, fifocnt) in musb_gadget.c; confirm kernel builds contain the referenced commit hashes and test gadget queue operations with oversized requests.

Typical attack path

1. Identify a target using the musb USB gadget driver with gadget functions enabled
2. Craft and submit a USB request exceeding packet size with unmapped buffer
3. Trigger rxstate processing to copy excess FIFO data past buffer bounds
4. Achieve memory corruption for crash or code execution

How to detect it

Examine kernel logs for USB gadget related oops or panic messages during request processing; review dmesg or syslog for musb rxstate entries around device attach events.

What your security team should do

• Apply the referenced kernel commit immediately on any systems using musb USB gadget drivers
• Monitor for new stable kernel releases containing the fix
• Limit exposure of USB gadget interfaces until patched
• Review downstream dependents for the same overflow pattern