{"id":"DEBIAN-CVE-2022-49501","details":"In the Linux kernel, the following vulnerability has been resolved:  usbnet: Run unregister_netdev() before unbind() again  Commit 2c9d6c2b871d (\"usbnet: run unbind() before unregister_netdev()\") sought to fix a use-after-free on disconnect of USB Ethernet adapters.  It turns out that a different fix is necessary to address the issue: https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/  So the commit was not necessary.  The commit made binding and unbinding of USB Ethernet asymmetrical: Before, usbnet_probe() first invoked the -\u003ebind() callback and then register_netdev().  usbnet_disconnect() mirrored that by first invoking unregister_netdev() and then -\u003eunbind().  Since the commit, the order in usbnet_disconnect() is reversed and no longer mirrors usbnet_probe().  One consequence is that a PHY disconnected (and stopped) in -\u003eunbind() is afterwards stopped once more by unregister_netdev() as it closes the netdev before unregistering.  That necessitates a contortion in -\u003estop() because the PHY may only be stopped if it hasn't already been disconnected.  Reverting the commit allows making the call to phy_stop() unconditional in -\u003estop().","modified":"2026-08-27T23:04:18.418444448Z","published":"2025-02-26T07:01:26.257Z","upstream":["CVE-2022-49501"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49501"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49501.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49501.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49501.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}