CVE-2022-49313: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49313 affects the Linux kernel's USB host driver, specifically in the oxubussuspend() function. The vulnerability was discovered and resolved in 2022, impacting the drivers/usb/host/oxu210hp-hcd.c component. This deadlock vulnerability occurs in the USB host controller driver when attempting to suspend the bus operation (NVD).

The vulnerability manifests as a deadlock condition in the oxubussuspend() function. The issue occurs when Thread 1 holds oxu->lock at position (1) and attempts to wait for a timer to stop using deltimersync(), while Thread 2 (timer handler) also requires the same lock at position (2). This creates a circular dependency where oxubussuspend() will block indefinitely (Kernel Commit).

When triggered, this vulnerability causes a deadlock in the USB host controller driver, resulting in the oxubussuspend() function blocking forever. This can lead to system hangs or unresponsiveness when attempting to suspend USB operations (NVD).

The issue has been fixed by extracting the deltimersync() call from the protection of spinlockirq(), allowing the timer handler to obtain the needed lock. The fix involves modifying the lock handling sequence in the oxubussuspend() function (Kernel Commit).