CVE-2022-49306: usb: dwc3: host: Stop setting the ACPI companion
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: host: Stop setting the ACPI companion
It is no longer needed. The sysdev pointer is now used when assigning the ACPI companions to the xHCI ports and USB devices.
Assigning the ACPI companion here resulted in the fwnode->secondary pointer to be replaced also for the parent dwc3 device since the primary fwnode (the ACPI companion) was shared. That was unintentional and it created potential side effects like resource leaks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49306?
CVE-2022-49306 is categorized as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2022-49306?
To fix CVE-2022-49306, upgrade to the latest version of the Linux kernel where the vulnerability is resolved.
What components are affected by CVE-2022-49306?
CVE-2022-49306 affects the USB subsystem of the Linux kernel specifically related to the dwc3 host driver.
Is CVE-2022-49306 exploitable remotely?
CVE-2022-49306 does not appear to be exploitable remotely as it requires local access to the system.
When was CVE-2022-49306 published?
CVE-2022-49306 was published on December 18, 2022.