CVE-2022-49299 is a vulnerability identified in the Linux kernel's USB gadget subsystem, specifically related to the dwc2 (DesignWare Core USB 2.0) gadget driver. The issue arises because the USB Device Controller (UDC) driver improperly resets the gadget driver's internal bus pointer (driver->bus). Historically, this action was harmless, but following a kernel commit that introduced a dedicated bus for the gadget subsystem, resetting this pointer leads to a NULL pointer dereference. This dereference triggers a kernel oops (crash) when the driver attempts to access the now-invalid bus pointer, causing the system to become unstable or crash. The vulnerability manifests during the loading or binding of the gadget driver, as demonstrated by the kernel trace involving module_add_driver and usb_gadget_register_driver_owner functions. The root cause is the UDC driver touching gadget driver internals inappropriately, specifically resetting the driver->bus field, which should be avoided. The fix involves removing the code that resets this pointer, thereby preventing the NULL pointer dereference. This vulnerability affects Linux kernel versions containing the faulty commit and is particularly relevant to systems using the dwc2 USB gadget driver, common in ARM-based embedded devices and SoCs such as Samsung Exynos platforms. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2022-49299 depends largely on their use of Linux-based embedded systems or ARM architectures that utilize the dwc2 USB gadget driver. The vulnerability can cause kernel crashes (denial of service) when the affected USB gadget driver is loaded or initialized, potentially leading to system instability or downtime. This is particularly critical for industrial control systems, IoT devices, network appliances, or embedded systems deployed in sectors such as manufacturing, telecommunications, healthcare, and critical infrastructure. While the vulnerability does not directly lead to privilege escalation or data leakage, the denial of service could disrupt operations, cause device reboots, or require manual intervention to restore functionality. In environments where high availability is essential, such as data centers or critical infrastructure, this could translate to operational and financial impacts. Additionally, devices that rely on USB gadget functionality for networking or device emulation may be rendered inoperative until patched. Since exploitation does not require user interaction but does require loading the affected driver, the attack surface is somewhat limited to scenarios where the vulnerable driver is actively used or loaded.

1. Apply the official Linux kernel patches that remove the resetting of the driver->bus pointer in the dwc2 gadget driver as soon as they become available. 2. For organizations using custom or embedded Linux kernels, ensure that kernel versions are updated to include this fix, especially on ARM-based devices using Samsung Exynos or similar SoCs. 3. Audit devices and systems to identify those running affected kernel versions with the dwc2 USB gadget driver enabled. 4. Where possible, disable USB gadget functionality if it is not required, reducing the attack surface. 5. Implement monitoring for kernel oops or crashes related to USB gadget driver loading to detect potential exploitation attempts or instability. 6. For critical systems, consider implementing kernel live patching solutions to minimize downtime during patch deployment. 7. Coordinate with hardware vendors and embedded system suppliers to confirm patch availability and deployment timelines. 8. Maintain strict control over module loading permissions to prevent unauthorized loading of vulnerable drivers.