Loading story…
CVE-2021-47582 affects the Linux kernel USB core's USBDEVFS_CONTROL and USBDEVFS_BULK ioctl paths in drivers/usb/core/devio.c. A local low-privileged user can issue requests with an excessively large timeout to an unresponsive USB device, leaving kernel tasks in uninterruptible waits long enough to trigger hung-task warnings and cause a denial-of-service condition. Red Hat rates the flaw as Low severity with a CVSS v3.1 score of 3.3.
The upstream fix replaces the affected usb_control_msg() and usb_bulk_msg() usage with purpose-built logic using killable waits and GFP_KERNEL allocation, making do_proc_control() and do_proc_bulk() interruptible. The issue was fixed upstream in Linux 5.15.11 and 5.16; Red Hat shipped corrected RHEL 8 kernel and kernel-rt packages through RHSA-2024:7000 and RHSA-2024:7001, while fixes for RHEL 9 were deferred.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:7000 for the Red Hat Enterprise Linux 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt package, addressing CVE-2021-47582. Red Hat rated the vulnerability Low severity with a CVSS v3.1 score of 3.3.
Linux kernel versions 5.15.11 and 5.16 fixed the issue by replacing affected usbfs message calls with logic using killable waits and GFP_KERNEL allocation.
The Linux kernel CVE team assigned CVE-2021-47582 to an improper-locking issue in the USBDEVFS_CONTROL and USBDEVFS_BULK ioctl paths. A low-privileged local user could use a large timeout with an unresponsive USB device to leave kernel tasks blocked and cause denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-48760** is a Linux kernel USB-core synchronization flaw that can leave processes indefinitely blocked in `usb_kill_urb()` on SMP systems. Insufficient memory ordering between concurrent `usb_kill_urb()` and `__usb_hcd_giveback_urb()` operations can cause a USB request block completion wake-up to be missed; equivalent store-buffering patterns also affect `usb_poison_urb()` and the failure path of `usb_hcd_submit_urb()`. The upstream fix adds full memory barriers through `smp_mb__after_atomic()` and is available in kernel versions 4.4.302, 4.9.300, 4.14.265, 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, and 5.17 or later. Red Hat rated the issue Low severity (CVSS 4.1) and released RHEL 8 kernel and kernel-rt updates in **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 9 fixes remain deferred, while RHEL 6 and 7 are outside support scope.
Aug 26, 2026
**CVE-2022-48836** is a moderate-severity Linux kernel flaw in `usb_submit_urb()` involving improper validation of USB endpoint types, associated with the Aiptek input driver. A local, low-privileged attacker can trigger the issue without user interaction, potentially causing a denial of service through high availability impact; Red Hat rates it CVSS 3.1 **5.5**. Red Hat released fixes in the `kernel` and `kernel-rt` packages for Red Hat Enterprise Linux 8. RHEL 9 remains affected, while its `kernel-rt` package is marked will not fix; RHEL 6 and 7 are outside support and should be treated as potentially vulnerable. The flaw maps to **CWE-1287**, in which software fails to enforce that supplied input matches its expected type, underscoring the need for strict allowlist-based validation of endpoint and other typed inputs.
Aug 26, 2026
Red Hat remediated **CVE-2023-1073**, a moderate-severity Linux kernel flaw in the Human Interface Device (HID) subsystem. A locally authenticated, low-privilege attacker with physical access could attach a crafted USB HID device whose descriptor creates an empty report list, causing `hid_validate_values()` to invoke `list_entry()` on an invalid entry. The resulting type confusion can produce an out-of-bounds write and memory corruption, potentially causing a system crash or local privilege escalation; Red Hat assigned CVSS 6.6. The underlying HID report-list issues were reported in `hid_validate_values()` and `bigben_probe()`, and upstream patches added checks requiring non-empty lists before the entries are used. The fix landed upstream in Linux 6.1.9 and was distributed through Fedora stable updates. Red Hat released corrected kernel packages for RHEL 8 and 9, relevant RHEL 8 Extended Update Support streams, kernel-rt packages, and Red Hat Virtualization 4 on RHEL 8; the RHEL 8.8 EUS kernel update `4.18.0-477.43.1.el8_8` includes the remediation. Administrators should apply the applicable kernel update and reboot systems to activate it; RHEL 6 is not affected and RHEL 7 is outside support scope.
Aug 26, 2026