CVE-2022-50876 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
usb: musb: Fix musb_gadget.c rxstate overflow bug
The usb function device call musb_gadget_queue() adds the passed request to musb_ep::req_list,If the (request->length > musb_ep->packet_sz) and (is_buffer_mapped(req) return false),the rxstate() will copy all data in fifo to request->buf which may cause request->buf out of bounds.
Fix it by add the length check : fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/26/2026
The vulnerability identified as CVE-2022-50876 represents a critical buffer overflow condition within the Linux kernel's USB Multi-Point Controller (MUSB) gadget driver implementation. This flaw exists in the musb_gadget.c file where the USB function device processing logic fails to properly validate buffer boundaries during data transfer operations. The issue specifically manifests when handling USB endpoint requests that exceed the configured packet size limits, creating a scenario where memory corruption can occur due to inadequate bounds checking mechanisms.
The technical root cause of this vulnerability stems from improper handling of the rxstate() function within the USB gadget driver architecture. When the musb_gadget_queue() function processes incoming USB requests, it appends these requests to the endpoint's request list structure. However, under specific conditions where the request length surpasses the configured packet size and the buffer mapping check fails, the system attempts to copy all available data from the FIFO buffer into the request buffer without proper length validation. This scenario directly violates fundamental memory safety principles and creates an exploitable condition that can lead to arbitrary code execution or system instability.
The operational impact of this vulnerability extends beyond simple memory corruption, as it represents a classic case of buffer overflow that aligns with CWE-121, which describes stack-based buffer overflow conditions. Attackers could potentially leverage this flaw to execute malicious code within the kernel context, bypassing standard security mechanisms and gaining elevated privileges. The vulnerability affects systems utilizing the MUSB USB gadget driver implementation, particularly those implementing USB device mode functionality where the gadget driver handles incoming data transfers from host devices. This makes it particularly concerning for embedded systems, IoT devices, and any platform where the Linux kernel serves as the underlying operating system for USB device management.
The mitigation strategy for this vulnerability involves implementing a precise length check mechanism that prevents buffer overflows by ensuring that the FIFO count does not exceed the remaining available space in the request buffer. The fix specifically introduces a minimum length calculation that bounds the data transfer to prevent exceeding the request buffer boundaries. This approach aligns with the ATT&CK framework's defensive techniques for memory corruption prevention and represents a standard security patch methodology. The solution demonstrates proper input validation practices that should be implemented across all kernel drivers handling USB data transfers, particularly in environments where untrusted USB devices may be connected. This patch exemplifies the importance of rigorous bounds checking in kernel space operations and serves as a critical update for all Linux distributions utilizing the affected MUSB gadget driver components.