CVE-2022-49962

xhci: Fix null pointer dereference in remove if xHC has only one roothub

published June 18, 2025

CVSS
—
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

xhci: Fix null pointer dereference in remove if xHC has only one roothub

The remove path in xhci platform driver tries to remove and put both main

and shared hcds even if only a main hcd exists (one roothub)

This causes a null pointer dereference in reboot for those controllers.

Check that the shared_hcd exists before trying to remove it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00215 · 11.2th percentile
Published
2025-06-18T11:00Z
EPSS history
Timeline
  • 18 JUN 11:00Z
    xhci: Fix null pointer dereference in remove if xHC has only one roothub
    cvelistv5