CVE-2022-50876: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50876 is a buffer overflow vulnerability in the Linux kernel's USB MUSB (Multi-Role USB controller) gadget driver, specifically in musb_gadget.c. The flaw exists in the rxstate() function, which can copy more data from the FIFO than the destination buffer (request->buf) can hold, resulting in an out-of-bounds write. It affects the Linux kernel across a wide range of stable branches, with fixes backported to versions 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. The CVE was published on December 30, 2025, and has an EPSS score of approximately 0.043% (Feedly, EUVD).

The root cause is a missing length check in the rxstate() function within drivers/usb/musb/musb_gadget.c, classifiable as CWE-120 (Buffer Copy without Checking Size of Input). When a USB gadget request is queued via musb_gadget_queue() with a request->length greater than musb_ep->packet_sz and is_buffer_mapped(req) returns false, rxstate() copies all data present in the hardware FIFO directly into request->buf without bounding the copy to the remaining buffer space. The fix introduces a min_t() check: fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);, ensuring the copy never exceeds the allocated buffer (Feedly, EUVD).

Successful exploitation of this vulnerability could result in kernel memory corruption due to the out-of-bounds write into request->buf. Depending on the memory layout, this could lead to a kernel panic (denial of service), privilege escalation, or arbitrary code execution in kernel context. The impact is primarily local, as exploitation requires the ability to interact with the MUSB USB gadget subsystem, which is typically available to processes with USB device access or physical USB connectivity.

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to the following fixed versions or later: 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, or 6.1. Distribution-specific kernel updates (e.g., SUSE kernel update SUSE-2026-0350-1) also incorporate this fix. As a workaround where patching is not immediately possible, disabling or blacklisting the musb_hdrc kernel module on systems that do not require MUSB USB gadget functionality can reduce exposure (Feedly, Linux Security).

Coverage of CVE-2022-50876 has been limited to routine vulnerability tracking by security scanners (Nessus plugin 281721, Qualys detections 760731 and 761056) and aggregation by vulnerability databases. A CISA weekly vulnerability summary for the week of December 29, 2025 included this CVE. No notable researcher commentary or significant community discussion has been identified (Red Packet Security, Tenable).