CVE-2022-25258

2022-02-1620:15:07

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

46.5%

JSON

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.

CPENameOperatorVersion
linuxeq2.6.29-rc8
linuxeq5.15-rc2
linuxeq5.3-rc1
linuxeq3.3-rc7
linuxeq5.5-rc1
linuxeq4.16-rc7
linuxeq2.6.22-rc4
linuxeq2.6.29-rc5
linuxeq2.6.18-rc3
linuxeq5.10

Name	Operator	Version
linux	eq	2.6.29-rc8
linux	eq	5.15-rc2
linux	eq	5.3-rc1
linux	eq	3.3-rc7
linux	eq	5.5-rc1
linux	eq	4.16-rc7
linux	eq	2.6.22-rc4
linux	eq	2.6.29-rc5
linux	eq	2.6.18-rc3
linux	eq	5.10