CVE-2022-48948: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes.

Affected products

• Linux Linux Kernel: from 2.6.35, before 4.9.337 (fixed in 4.9.337); from 4.10, before 4.14.303 (fixed in 4.14.303); from 4.15, before 4.19.270 (fixed in 4.19.270); from 4.20, before 5.4.229 (fixed in 5.4.229); from 5.5, before 5.10.161 (fixed in 5.10.161); from 5.11, before 5.15.85 (fixed in 5.15.85); …

Published 2024-10-21. Last modified 2026-06-17.