CVE-2022-49498: ALSA: pcm: Check for null pointer of pointer substream before dereferencing it
First published: Wed Feb 26 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Check for null pointer of pointer substream before dereferencing it Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=5.6<5.10.121 | |
| Linux Kernel | >=5.11<5.15.46 | |
| Linux Kernel | >=5.16<5.17.14 | |
| Linux Kernel | >=5.18<5.18.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/b2421a196cb0911ea95aec1050a0b830464c8fa6
- https://git.kernel.org/stable/c/f2c68c52898f623fe84518da4606538d193b0cca
- https://git.kernel.org/stable/c/7784d22f81a29df2ec57ca90d54f93a35cbcd1a2
- https://git.kernel.org/stable/c/1f2e28857be1e5c7db39bbc221332215fc5467e3
- https://git.kernel.org/stable/c/b41ef7ad9238c22aa2e142f5ce4ce1a1a0d48123
- https://git.kernel.org/stable/c/011b559be832194f992f73d6c0d5485f5925a10b
Frequently Asked Questions
What is the severity of CVE-2022-49498?
CVE-2022-49498 has a medium severity rating as it affects the ALSA subsystem in the Linux kernel.
How do I fix CVE-2022-49498?
To fix CVE-2022-49498, update the Linux kernel to a version that is not affected by this vulnerability.
What systems are affected by CVE-2022-49498?
CVE-2022-49498 affects Linux kernel versions between 5.6 and 5.10.121, 5.11 and 5.15.46, 5.16 and 5.17.14, and 5.18 and 5.18.3.
What type of vulnerability is CVE-2022-49498?
CVE-2022-49498 is a null pointer dereference vulnerability in the ALSA subsystem of the Linux kernel.
Can CVE-2022-49498 be exploited remotely?
CVE-2022-49498 typically requires local access for exploitation, as it involves the kernel ALSA subsystem.
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/type
- agent/references
- agent/title
- agent/author
- agent/source
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.6
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/5.18