CVE-2022-50028: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50028 is a stack corruption vulnerability in the Linux kernel's gadgetfs (USB gadget filesystem) subsystem, specifically in the ep_io operation. When wait_for_completion_interruptible() is interrupted after usb_ep_queue() has been called, the code fails to wait for the IRQ to finish, allowing complete() from epio_complete() to corrupt the stack. The vulnerability affects multiple Linux kernel versions: before 4.9.326, 4.10–4.14.291, 4.15–4.19.256, 4.20–5.4.211, 5.5–5.10.138, 5.11–5.15.63, and 5.16–5.19.4. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a race condition (CWE-362) in the gadgetfs ep_io path: after usb_ep_queue() submits a USB endpoint request, if the blocking call wait_for_completion_interruptible() is interrupted by a signal, the function returns early without waiting for the associated IRQ handler (epio_complete()) to finish. When the IRQ subsequently fires and calls complete(), it operates on a stack frame that may have already been unwound, resulting in stack memory corruption. Exploitation requires local access with low privileges on a system where the USB gadget filesystem is mounted and in use (Feedly, Kernel Patches).

Successful exploitation can cause stack corruption in the Linux kernel, leading to a system crash or hang — a denial of service with high availability impact. There is no confidentiality or integrity impact identified, and the vulnerability is locally scoped with no potential for lateral movement or data exfiltration. Systems using USB gadget functionality (e.g., embedded Linux devices, development boards acting as USB peripherals) are most at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.024% (0.000240), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local, low-privilege access and the presence of an active USB gadget filesystem, which significantly limits the attack surface (Feedly).

Patches are available for all affected Linux kernel stable branches: upgrade to versions 4.9.326, 4.14.291, 4.19.256, 5.4.211, 5.10.138, 5.15.63, or 5.19.4 (or later). For systems that cannot be immediately patched, restrict local user access to minimize exploitation risk and monitor USB gadget filesystem interactions. Disabling or unmounting the gadgetfs on systems that do not require USB gadget functionality is an effective workaround. SUSE has issued kernel security advisories addressing this CVE (SUSE Advisory, Kernel Patches).

SUSE has issued multiple kernel security advisories covering CVE-2022-50028 as part of broader Linux kernel update packages (SUSE Advisory). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.