Loading story…
CVE-2022-48836 is a moderate-severity Linux kernel flaw in usb_submit_urb() involving improper validation of USB endpoint types, associated with the Aiptek input driver. A local, low-privileged attacker can trigger the issue without user interaction, potentially causing a denial of service through high availability impact; Red Hat rates it CVSS 3.1 5.5.
Red Hat released fixes in the kernel and kernel-rt packages for Red Hat Enterprise Linux 8. RHEL 9 remains affected, while its kernel-rt package is marked will not fix; RHEL 6 and 7 are outside support and should be treated as potentially vulnerable. The flaw maps to CWE-1287, in which software fails to enforce that supplied input matches its expected type, underscoring the need for strict allowlist-based validation of endpoint and other typed inputs.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt package, fixing CVE-2022-48836. The Linux kernel flaw involves improper validation of USB endpoint types in usb_submit_urb() associated with the aiptek input driver.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47582** affects the Linux kernel USB core's `USBDEVFS_CONTROL` and `USBDEVFS_BULK` ioctl paths in `drivers/usb/core/devio.c`. A local low-privileged user can issue requests with an excessively large timeout to an unresponsive USB device, leaving kernel tasks in uninterruptible waits long enough to trigger hung-task warnings and cause a denial-of-service condition. Red Hat rates the flaw as Low severity with a CVSS v3.1 score of 3.3. The upstream fix replaces the affected `usb_control_msg()` and `usb_bulk_msg()` usage with purpose-built logic using killable waits and `GFP_KERNEL` allocation, making `do_proc_control()` and `do_proc_bulk()` interruptible. The issue was fixed upstream in Linux 5.15.11 and 5.16; Red Hat shipped corrected RHEL 8 kernel and kernel-rt packages through RHSA-2024:7000 and RHSA-2024:7001, while fixes for RHEL 9 were deferred.
Aug 26, 2026
Red Hat remediated **CVE-2023-1073**, a moderate-severity Linux kernel flaw in the Human Interface Device (HID) subsystem. A locally authenticated, low-privilege attacker with physical access could attach a crafted USB HID device whose descriptor creates an empty report list, causing `hid_validate_values()` to invoke `list_entry()` on an invalid entry. The resulting type confusion can produce an out-of-bounds write and memory corruption, potentially causing a system crash or local privilege escalation; Red Hat assigned CVSS 6.6. The underlying HID report-list issues were reported in `hid_validate_values()` and `bigben_probe()`, and upstream patches added checks requiring non-empty lists before the entries are used. The fix landed upstream in Linux 6.1.9 and was distributed through Fedora stable updates. Red Hat released corrected kernel packages for RHEL 8 and 9, relevant RHEL 8 Extended Update Support streams, kernel-rt packages, and Red Hat Virtualization 4 on RHEL 8; the RHEL 8.8 EUS kernel update `4.18.0-477.43.1.el8_8` includes the remediation. Administrators should apply the applicable kernel update and reboot systems to activate it; RHEL 6 is not affected and RHEL 7 is outside support scope.
Aug 26, 2026
**CVE-2022-48760** is a Linux kernel USB-core synchronization flaw that can leave processes indefinitely blocked in `usb_kill_urb()` on SMP systems. Insufficient memory ordering between concurrent `usb_kill_urb()` and `__usb_hcd_giveback_urb()` operations can cause a USB request block completion wake-up to be missed; equivalent store-buffering patterns also affect `usb_poison_urb()` and the failure path of `usb_hcd_submit_urb()`. The upstream fix adds full memory barriers through `smp_mb__after_atomic()` and is available in kernel versions 4.4.302, 4.9.300, 4.14.265, 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, and 5.17 or later. Red Hat rated the issue Low severity (CVSS 4.1) and released RHEL 8 kernel and kernel-rt updates in **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 9 fixes remain deferred, while RHEL 6 and 7 are outside support scope.
Aug 26, 2026