xhci: Fix null pointer dereference in remove if xHC has only one roothub

{
  "id": "062fb85bc7179026d46c36146dd5243f0ae313a73f712215d9796a7131dd35fe",
  "url": "https://osv.dev/vulnerability/CVE-2022-49962",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "xhci: Fix null pointer dereference in remove if xHC has only one roothub",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference in remove if xHC has only one roothub The remove path in xhci platform driver tries to remove and put both main and shared hcds even if only a main hcd exists (one roothub) This causes a null pointer dereference in reboot for those controllers. Check that the shared_hcd exists before trying to remove it.",
    "evidence": "osv:CVE-2022-49962",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.19.8",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2022-49962",
      "aliases": [
        "CVE-2022-49962"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "e0fe986972f5b6b12086c73569206dd29c520be9"
                },
                {
                  "fixed": "7081b2f34ff291ada012bd6abacaf7d51c4cf73f"
                },
                {
                  "fixed": "4a593a62a9e3a25ab4bc37f612e4edec144f7f43"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49962.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.19.0"
                },
                {
                  "fixed": "5.19.8"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49962.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:42.650854928Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/4a593a62a9e3a25ab4bc37f612e4edec144f7f43",
        "https://git.kernel.org/stable/c/7081b2f34ff291ada012bd6abacaf7d51c4cf73f",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49962.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-49962",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49962.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-49962",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 510222,
  "published_at": "2025-06-18T11:00:23.321+00:00"
}