USB Gadget f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS

Kernel Updated 02 Oct 2025

Summary

18/02/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1000250: usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS. Affects Kernel versions >= 90c4d05780d47e14a50e11a7f17373104cd47d25, < 27980463256060aaef8db0ddfcf40fd2342b96e8. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The USB Gadget f_sourcesink is a component in the Linux Kernel that provides support for USB functions in devices. It allows devices to act as USB gadgets, enabling them to function as USB peripherals. This vulnerability affects the f_sourcesink component when used with USB_SPEED_SUPER_PLUS, a high-speed USB transfer mode.

Vulnerability Detail

The vulnerability in the USB Gadget f_sourcesink component arises from an issue with isochronous (isoc) transfers when operating in USB_SPEED_SUPER_PLUS mode. This issue can lead to data corruption or loss during isoc transfers, potentially impacting the functionality and reliability of USB devices. The vulnerability was introduced in Linux Kernel version v5.13 and has been fixed in version v5.15.19 by commit 27980463256060aaef8db0ddfcf40fd2342b96e8.

How To Fix

No fixed version is published for this vulnerability.

To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.15.19 or later. This can be done by obtaining the updated kernel source code from the official Linux Kernel repository and compiling it for the target system. Alternatively, users can wait for their Linux distribution to provide an updated package containing the fixed version of the kernel.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Linux Kernel.

Conclusion

The USB Gadget f_sourcesink vulnerability in the Linux Kernel when operating in USB_SPEED_SUPER_PLUS mode can lead to data corruption or loss during isochronous transfers. It is crucial to update the Linux Kernel to version v5.15.19 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →

FAQ

What is USB_SPEED_SUPER_PLUS?

USB_SPEED_SUPER_PLUS is a high-speed USB transfer mode that provides faster data transfer rates compared to other USB transfer modes. It is commonly used in devices that require high bandwidth, such as external storage devices and video capture devices.

How can I check if my system is affected by this vulnerability?

You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this USB Gadget f_sourcesink vulnerability.