CVE-2022-48760 is a concurrency-related vulnerability in the Linux kernel's USB core subsystem. The issue arises from improper memory ordering on symmetric multiprocessing (SMP) systems during the execution of usb_kill_urb() and __usb_hcd_giveback_urb() functions, which manage USB Request Blocks (URBs). Specifically, the problem is due to the lack of appropriate memory barriers around atomic operations on urb->reject and urb->use_count variables. On SMP systems, the CPUs may reorder memory accesses, causing a scenario known as Store Buffering (SB). In this case, CPU 0 writes to urb->reject and then reads urb->use_count, while CPU 1 writes urb->use_count and then reads urb->reject. Without memory barriers, these reads can be executed before the writes, leading to inconsistent views of these variables across CPUs. Consequently, usb_kill_urb() can hang indefinitely because CPU 0 waits on a condition that never becomes true, as it misses the wakeup notification triggered by CPU 1. This hang affects USB device removal or cancellation operations, potentially causing system instability or denial of service. The vulnerability also affects usb_poison_urb() and the failure path of usb_hcd_submit_urb(). The fix involves adding full memory barriers (smp_mb__after_atomic()) after atomic increments and decrements to enforce proper ordering and ensure wakeup notifications are reliably delivered. This patch prevents the hang by guaranteeing that the updates to urb->reject and urb->use_count are seen in the correct order across CPUs. The vulnerability was identified by the syzbot fuzzer and affects Linux kernel versions prior to the patch commit identified by the hash 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2. No known exploits are reported in the wild at this time.

For European organizations, this vulnerability could lead to system hangs or denial of service on Linux systems that handle USB devices, particularly those running on SMP architectures. Since Linux is widely used in servers, embedded systems, and industrial control systems across Europe, the impact could affect critical infrastructure, enterprise servers, and endpoint devices relying on USB peripherals. The hang in usb_kill_urb() may cause USB device removal or cancellation operations to stall, potentially leading to degraded system performance or requiring manual intervention to recover. In environments where USB devices are used for security tokens, storage, or communication, this could disrupt business operations or security workflows. Although the vulnerability does not directly lead to privilege escalation or data leakage, the denial of service effect can be significant in high-availability or real-time systems. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to potential future attacks or accidental hangs triggered by normal USB device operations.

European organizations should promptly update their Linux kernel versions to include the patch that adds the necessary memory barriers to the USB core subsystem. This involves applying the kernel update identified by the commit hash 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 or later. For systems where immediate patching is not feasible, administrators should monitor USB device activity closely and consider limiting or controlling USB device usage to reduce exposure. Implementing kernel live patching solutions where available can minimize downtime. Additionally, organizations should audit their SMP Linux systems to identify those running affected kernel versions and prioritize patching on critical infrastructure and systems with high USB device interaction. Testing patches in staging environments before deployment is recommended to avoid regressions. Finally, maintaining robust system monitoring and alerting for USB-related hangs or kernel stalls can help detect exploitation attempts or accidental triggers early.