CVE-2022-50704

A use-after-free vulnerability was found in the Linux kernel's USB gadget subsystem. When switching USB configuration from RNDIS to another configuration, if the hardware's pullup callback fails (either unsupported or hardware fault), the error handling path triggers rndis_close() on already-freed memory. This occurs because the gadget disconnect sequence frees resources that are later accessed during configfs cleanup, causing a system panic.

This flaw affects systems using USB gadget mode with RNDIS (Remote NDIS) functionality, typically found in embedded Linux devices acting as USB peripherals. The vulnerability requires local access to manipulate configfs entries and trigger a hardware error condition during USB configuration changes. The race between disconnect and cleanup operations makes exploitation timing-dependent.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.