GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48716 (GCVE-0-2022-48716)

Vulnerability from cvelistv5 – Published: 2024-06-20 11:13 – Updated: 2026-08-05 08:51
VLAI
Title
ASoC: codecs: wcd938x: fix incorrect used of portid
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix incorrect used of portid Mixer controls have the channel id in mixer->reg, which is not same as port id. port id should be derived from chan_info array. So fix this. Without this, its possible that we could corrupt struct wcd938x_sdw_priv by accessing port_map array out of range with channel id instead of port id.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-25 13:56 UTC
CWE
  • CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e8ba1e05bdc016700c85fad559a812c2e795442f , < aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f (git)
Affected: e8ba1e05bdc016700c85fad559a812c2e795442f , < 9167f2712dc8c24964840a4d1e2ebf130e846b95 (git)
Affected: e8ba1e05bdc016700c85fad559a812c2e795442f , < c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.22 , ≤ 5.15.* (semver)
Unaffected: 5.16.8 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
linux linux_kernel Affected: e8ba1e05bdc0 , < aa7152f9f117 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Affected: e8ba1e05bdc0 , < 9167f2712dc8 (custom)
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Affected: e8ba1e05bdc0 , < c5c1546a654f (custom)
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Affected: 5.14
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Unaffected: 0 , < 5.14 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Unaffected: 5.15.22 , ≤ 5.16 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Unaffected: 5.16.8 , ≤ 5.17 (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
linux linux_kernel Unaffected: 5.17
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "aa7152f9f117",
                "status": "affected",
                "version": "e8ba1e05bdc0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "9167f2712dc8",
                "status": "affected",
                "version": "e8ba1e05bdc0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "c5c1546a654f",
                "status": "affected",
                "version": "e8ba1e05bdc0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.14"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.14",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.16",
                "status": "unaffected",
                "version": "5.15.22",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.17",
                "status": "unaffected",
                "version": "5.16.8",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.17"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-48716",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-25T13:56:06.745366Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-25T14:04:19.940Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.862Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/wcd938x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f",
              "status": "affected",
              "version": "e8ba1e05bdc016700c85fad559a812c2e795442f",
              "versionType": "git"
            },
            {
              "lessThan": "9167f2712dc8c24964840a4d1e2ebf130e846b95",
              "status": "affected",
              "version": "e8ba1e05bdc016700c85fad559a812c2e795442f",
              "versionType": "git"
            },
            {
              "lessThan": "c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7",
              "status": "affected",
              "version": "e8ba1e05bdc016700c85fad559a812c2e795442f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/codecs/wcd938x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.22",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.8",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: wcd938x: fix incorrect used of portid\n\nMixer controls have the channel id in mixer-\u003ereg, which is not same\nas port id. port id should be derived from chan_info array.\nSo fix this. Without this, its possible that we could corrupt\nstruct wcd938x_sdw_priv by accessing port_map array out of range\nwith channel id instead of port id."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by writing ALSA mixer controls (e.g. DSD_L/DSD_R Switch) via ioctl on /dev/snd/controlC*, a local device-file interface; it is not reachable from the network stack or remote protocols.\nAC:L - An attacker who can open the sound control device can reliably toggle the fixed DSD mixer controls; no race, non-deterministic state, or other condition outside attacker control is required.\nPR:L - snd_ctl_elem_write performs no capability check; access depends only on /dev/snd/controlC* permissions, typically granted to unprivileged audio-group users on affected Qualcomm devices (phones, Chromebooks, ThinkPad X13s), not real root.\nUI:N - The attacker triggers the OOB write directly by writing the mixer control; no separate victim action is required.\nS:U - This is standard in-kernel memory corruption of wcd938x_sdw_priv with impact confined to the host kernel\u0027s security authority, not a VM/IOMMU/sandbox boundary cross.\nC:H - The OOB write corrupts the adjacent ch_info pointer inside wcd938x_sdw_priv; subsequent use of that corrupted pointer enables kernel memory disclosure primitives, so confidentiality impact is High.\nI:H - Out-of-bounds write into port_config[port_num] (port 5 / DSD) overwrites trailing structure fields and yields kernel memory corruption exploitable for integrity compromise and control-flow hijacking.\nA:H - Dereferencing the corrupted ch_info pointer after the OOB write can oops/panic the kernel, causing a full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:51:53.731Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7"
        }
      ],
      "title": "ASoC: codecs: wcd938x: fix incorrect used of portid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48716",
    "datePublished": "2024-06-20T11:13:09.315Z",
    "dateReserved": "2024-06-20T11:09:39.050Z",
    "dateUpdated": "2026-08-05T08:51:53.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48716",
      "date": "2026-09-16",
      "epss": "0.00459",
      "percentile": "0.38835"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: codecs: wcd938x: fix incorrect used of portid\\n\\nMixer controls have the channel id in mixer-\u003ereg, which is not same\\nas port id. port id should be derived from chan_info array.\\nSo fix this. Without this, its possible that we could corrupt\\nstruct wcd938x_sdw_priv by accessing port_map array out of range\\nwith channel id instead of port id.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: ASoC: c\\u00f3decs: wcd938x: corrige el uso incorrecto del puerto Los controles del mezclador tienen la identificaci\\u00f3n del canal en mezclador-\u0026gt;reg, que no es la misma que la identificaci\\u00f3n del puerto. La identificaci\\u00f3n del puerto debe derivarse de la matriz chan_info. Entonces arregla esto. Sin esto, es posible que podamos da\\u00f1ar la estructura wcd938x_sdw_priv accediendo a la matriz port_map fuera del rango con la identificaci\\u00f3n del canal en lugar de la identificaci\\u00f3n del puerto.\"}]",
      "id": "CVE-2022-48716",
      "lastModified": "2024-11-21T07:33:50.933",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-06-20T11:15:55.207",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-400\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:23:04.000Z",
      "cve": "CVE-2022-48716",
      "id": "msrc_CVE-2022-48716",
      "initial_release_date": "2024-06-02T07:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ASoC: codecs: wcd938x: fix incorrect used of portid",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2022-48716.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48716\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-20T11:15:55.207\",\"lastModified\":\"2026-08-04T10:17:17.110\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: codecs: wcd938x: fix incorrect used of portid\\n\\nMixer controls have the channel id in mixer-\u003ereg, which is not same\\nas port id. port id should be derived from chan_info array.\\nSo fix this. Without this, its possible that we could corrupt\\nstruct wcd938x_sdw_priv by accessing port_map array out of range\\nwith channel id instead of port id.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ASoC: c\u00f3decs: wcd938x: corrige el uso incorrecto del puerto Los controles del mezclador tienen la identificaci\u00f3n del canal en mezclador-\u0026gt;reg, que no es la misma que la identificaci\u00f3n del puerto. La identificaci\u00f3n del puerto debe derivarse de la matriz chan_info. Entonces arregla esto. Sin esto, es posible que podamos da\u00f1ar la estructura wcd938x_sdw_priv accediendo a la matriz port_map fuera del rango con la identificaci\u00f3n del canal en lugar de la identificaci\u00f3n del puerto.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/soc/codecs/wcd938x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e8ba1e05bdc016700c85fad559a812c2e795442f\",\"lessThan\":\"aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8ba1e05bdc016700c85fad559a812c2e795442f\",\"lessThan\":\"9167f2712dc8c24964840a4d1e2ebf130e846b95\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8ba1e05bdc016700c85fad559a812c2e795442f\",\"lessThan\":\"c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/soc/codecs/wcd938x.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.22\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.8\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"e8ba1e05bdc0\",\"lessThan\":\"aa7152f9f117\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"e8ba1e05bdc0\",\"lessThan\":\"9167f2712dc8\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"e8ba1e05bdc0\",\"lessThan\":\"c5c1546a654f\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.15.22\",\"lessThanOrEqual\":\"5.16\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.16.8\",\"lessThanOrEqual\":\"5.17\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"5.17\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-25T13:56:06.745366Z\",\"id\":\"CVE-2022-48716\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.22\",\"matchCriteriaId\":\"E324C55A-AED6-403F-B530-DCFDAC30AD06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.8\",\"matchCriteriaId\":\"0623892A-E3E4-44E6-8A5E-39A0B47AF782\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E6E34B23-78B4-4516-9BD8-61B33F4AC49A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:42:56+00:00",
      "cve": "CVE-2022-48716",
      "id": "CVE-2022-48716",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: codecs: wcd938x: fix incorrect used of portid",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48716.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:07:57Z",
      "cve": "CVE-2022-48716",
      "id": "CVE-2022-48716",
      "initial_release_date": "2024-06-22T04:09:31Z",
      "product_status:known_affected": "397",
      "product_status:known_not_affected": "294",
      "product_status:recommended": "298",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48716",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48716.json",
      "version": "53"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:17:55.862Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48716\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-25T13:56:06.745366Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e8ba1e05bdc0\", \"lessThan\": \"aa7152f9f117\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e8ba1e05bdc0\", \"lessThan\": \"9167f2712dc8\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"e8ba1e05bdc0\", \"lessThan\": \"c5c1546a654f\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.15.22\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.16.8\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.17\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.17\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-25T13:57:56.487Z\"}}], \"cna\": {\"title\": \"ASoC: codecs: wcd938x: fix incorrect used of portid\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached by writing ALSA mixer controls (e.g. DSD_L/DSD_R Switch) via ioctl on /dev/snd/controlC*, a local device-file interface; it is not reachable from the network stack or remote protocols.\\nAC:L - An attacker who can open the sound control device can reliably toggle the fixed DSD mixer controls; no race, non-deterministic state, or other condition outside attacker control is required.\\nPR:L - snd_ctl_elem_write performs no capability check; access depends only on /dev/snd/controlC* permissions, typically granted to unprivileged audio-group users on affected Qualcomm devices (phones, Chromebooks, ThinkPad X13s), not real root.\\nUI:N - The attacker triggers the OOB write directly by writing the mixer control; no separate victim action is required.\\nS:U - This is standard in-kernel memory corruption of wcd938x_sdw_priv with impact confined to the host kernel\u0027s security authority, not a VM/IOMMU/sandbox boundary cross.\\nC:H - The OOB write corrupts the adjacent ch_info pointer inside wcd938x_sdw_priv; subsequent use of that corrupted pointer enables kernel memory disclosure primitives, so confidentiality impact is High.\\nI:H - Out-of-bounds write into port_config[port_num] (port 5 / DSD) overwrites trailing structure fields and yields kernel memory corruption exploitable for integrity compromise and control-flow hijacking.\\nA:H - Dereferencing the corrupted ch_info pointer after the OOB write can oops/panic the kernel, causing a full availability loss.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e8ba1e05bdc016700c85fad559a812c2e795442f\", \"lessThan\": \"aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e8ba1e05bdc016700c85fad559a812c2e795442f\", \"lessThan\": \"9167f2712dc8c24964840a4d1e2ebf130e846b95\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e8ba1e05bdc016700c85fad559a812c2e795442f\", \"lessThan\": \"c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7\", \"versionType\": \"git\"}], \"programFiles\": [\"sound/soc/codecs/wcd938x.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.22\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"sound/soc/codecs/wcd938x.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f\"}, {\"url\": \"https://git.kernel.org/stable/c/9167f2712dc8c24964840a4d1e2ebf130e846b95\"}, {\"url\": \"https://git.kernel.org/stable/c/c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: codecs: wcd938x: fix incorrect used of portid\\n\\nMixer controls have the channel id in mixer-\u003ereg, which is not same\\nas port id. port id should be derived from chan_info array.\\nSo fix this. Without this, its possible that we could corrupt\\nstruct wcd938x_sdw_priv by accessing port_map array out of range\\nwith channel id instead of port id.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.22\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.8\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:51:53.731Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48716\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:51:53.731Z\", \"dateReserved\": \"2024-06-20T11:09:39.050Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-20T11:13:09.315Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.