CVE-2022-4662: Linux Kernel USB Core DoS Vulnerability

CVE-2022-4662 Overview

CVE-2022-4662 is an incorrect access control vulnerability in the Linux kernel USB core subsystem. The flaw exists in the code path that handles user-attached USB devices. A local user can trigger the condition to crash the system, resulting in denial of service. The issue is categorized under [CWE-455] (Non-exit on Failed Initialization) and affects multiple versions of the Linux kernel, including 6.0 release candidates.

Critical Impact
A local, low-privileged user can attach a USB device in a way that crashes the kernel, producing a full system denial of service on affected Linux hosts.

Affected Products

Linux Kernel (multiple versions up to and including affected releases)
Linux Kernel 6.0-rc1
Linux Kernel 6.0-rc2 and 6.0-rc3

Discovery Timeline

2022-12-22 - CVE-2022-4662 published to the National Vulnerability Database (NVD)
2025-04-09 - Last updated in NVD database

Technical Details for CVE-2022-4662

Vulnerability Analysis

The vulnerability resides in the Linux kernel USB core subsystem, the layer responsible for enumerating and managing USB devices when they are attached to the host. The kernel performs insufficient access control checks during the device attachment path. As a result, a local user with the ability to attach a USB device can drive the kernel into an inconsistent state that terminates with a crash.

The weakness maps to [CWE-455], which covers cases where code fails to exit or properly handle failed initialization. When initialization of a USB device entry does not abort cleanly on error, subsequent code paths operate on partially constructed structures and trigger a kernel panic or oops.

Because the impact is limited to availability, confidentiality and integrity are not affected. However, kernel crashes on shared systems, virtualization hosts, or industrial endpoints can interrupt all running workloads.

Root Cause

The root cause is improper access control combined with non-exit on failed initialization in the USB attachment workflow. The kernel does not adequately validate the state or permissions associated with the user-initiated USB attach operation before proceeding through initialization steps that assume valid preconditions.

Attack Vector

Exploitation requires local access and low privileges. No user interaction beyond initiating the USB attach is needed. The attacker triggers the flaw by attaching or interacting with a USB device through the standard kernel interface, causing the subsystem to follow the faulty code path and crash the host. Remote exploitation is not possible.

No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Linux Kernel Mailing List Post for upstream discussion of the fix.

Detection Methods for CVE-2022-4662

Indicators of Compromise

Unexpected kernel panic or oops messages in dmesg or /var/log/kern.log referencing USB core functions immediately after a USB attach event.
Repeated system reboots or hangs correlated with USB hotplug activity from a local user session.
udev events showing USB device attachment immediately preceding kernel termination.

Detection Strategies

Monitor kernel ring buffer output for crash signatures in USB core subsystem call stacks.
Correlate udev and systemd-journald events for USB attach actions performed by non-root users on multi-user hosts.
Track running kernel versions against the affected version list using configuration management or vulnerability scanners.

Monitoring Recommendations

Forward kernel logs and audit records to a central log platform and alert on kernel panic patterns tied to USB drivers.
Baseline expected USB attach events for servers and virtualization hosts where physical USB activity should be rare.
Audit which local accounts have shell access on systems exposed to physical USB ports, including kiosks and lab machines.

How to Mitigate CVE-2022-4662

Immediate Actions Required

Upgrade the Linux kernel to a version that includes the upstream fix for the USB core access control flaw.
Inventory hosts running affected 6.0-rc kernels and any vendor kernels that backport the affected USB core code.
Restrict physical and logical access to USB ports on shared and production systems until patching is complete.

Patch Information

The fix was merged upstream through the Linux kernel maintainers. Apply distribution-provided kernel updates that reference CVE-2022-4662, or rebuild from a mainline kernel that includes the corrected USB core attachment logic. See the Linux Kernel Mailing List Message for upstream context.

Workarounds

Disable the USB storage and unused USB host controller modules on systems that do not require USB connectivity.
Use udev rules to deny non-root users the ability to attach or interact with USB devices.
Apply BIOS or firmware policies to disable physical USB ports on servers and appliances where USB is not operationally required.

bash

# Example udev rule to restrict USB device access to root only
# Place in /etc/udev/rules.d/99-restrict-usb.rules
SUBSYSTEM=="usb", MODE="0600", OWNER="root", GROUP="root"

# Reload udev rules after applying
udevadm control --reload-rules && udevadm trigger

# Optionally blacklist usb-storage if not needed
echo "blacklist usb-storage" | sudo tee /etc/modprobe.d/blacklist-usb-storage.conf