CVE-2022-49498

MEDIUM

Linux Kernel 5.6-5.18.3 ALSA PCM Substream NULL Pointer Dereference

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Check for null pointer of pointer substream before dereferencing it Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned.

References (6)

Core 6

Scores

CVSS v3 5.5
EPSS 0.0025
EPSS Percentile 15.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (18)
linux/Kernel 5.11.0 - 5.15.46linux
linux/Kernel 5.16.0 - 5.17.14linux
linux/Kernel 5.18.0 - 5.18.3linux
linux/Kernel 5.6.0 - 5.10.121linux
Linux/Linux < 5.6
Linux/Linux 5.10.121 - 5.10.*
Linux/Linux 5.15.46 - 5.15.*
Linux/Linux 5.17.14 - 5.17.*
Linux/Linux 5.18.3 - 5.18.*
Linux/Linux 5.19
... and 8 more
Published Feb 26, 2025
Tracked Since Feb 18, 2026