CVE-2022-50470

A null pointer/list corruption flaw was found in the Linux kernel USB xHCI host controller code. When the xHCI host is dying or being removed, some device endpoints may remain on the software bandwidth list. Later cleanup deletes entries that were already freed, corrupting the list and crashing the kernel. A local user could use this flaw to crash system, causing denial of service.

This vulnerability is limited to systems using software bandwidth checking, noted as affecting Intel Panther Point PCH (Ivy Bridge) xHC; other hosts perform bandwidth checks in hardware. The crash occurs when endpoints aren’t dropped cleanly as the controller is removed/dies, leaving them on the bandwidth list; subsequent free-path cleanup (xhci_mem_cleanup) attempts to delete already-freed endpoints, corrupting the list and triggering a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module xhci_pci from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.