CVE-2022-50484

A memory leak was found in the Linux kernel's USB audio driver in the synchronization endpoint URB allocation path. When memory allocation fails partway through allocating URBs for a sync endpoint, the error handling code fails to release the partially allocated URBs because the endpoint's URB counter hasn't been updated yet. This leaves allocated URBs orphaned in memory, leading to resource exhaustion and denial of service with repeated failures.

USB audio devices often use isochronous endpoints for audio streaming, with separate synchronization endpoints for clock recovery. During initialization, the driver allocates multiple URBs (USB Request Blocks) for these endpoints. The allocation happens in a loop: create URB, allocate buffer, repeat. The ep->nurbs field tracks how many URBs have been successfully allocated. Here's the problem: ep->nurbs is only set after the entire loop completes successfully. If allocation fails midway—say, the driver successfully allocates 5 URBs but fails on the 6th due to -ENOMEM—the error handler is supposed to clean up. It loops from 0 to ep->nurbs, freeing each URB. But since ep->nurbs is still zero (it was never updated), the loop doesn't execute at all. The 5 successfully allocated URBs are simply abandoned. Each time USB audio initialization fails under memory pressure, more URBs leak. The fix is simple: set ep->nurbs before starting the loop, so the cleanup knows how far to iterate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.