CVE-2022-48927 (GCVE-0-2022-48927)

Vulnerability from cvelistv5 – Published: 2024-08-22 03:31 – Updated: 2026-08-05 08:52
VLAI
Title
iio: adc: tsc2046: fix memory corruption by preventing array overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: iio: adc: tsc2046: fix memory corruption by preventing array overflow On one side we have indio_dev->num_channels includes all physical channels + timestamp channel. On other side we have an array allocated only for physical channels. So, fix memory corruption by ARRAY_SIZE() instead of num_channels variable. Note the first case is a cleanup rather than a fix as the software timestamp channel bit in active_scanmask is never set by the IIO core.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9374e8f5a38defe90bc65b2decf317c1c62d91dd , < 0cb9b2f73c182d242a640e512f4785c7c504512f (git)
Affected: 9374e8f5a38defe90bc65b2decf317c1c62d91dd , < 082d2c047b0d305bb0b6e9f9d671a09470e2db2d (git)
Affected: 9374e8f5a38defe90bc65b2decf317c1c62d91dd , < b7a78a8adaa8849c02f174d707aead0f85dca0da (git)
Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.26 , ≤ 5.15.* (semver)
Unaffected: 5.16.12 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48927",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:33:02.652045Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:00.502Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/ti-tsc2046.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0cb9b2f73c182d242a640e512f4785c7c504512f",
              "status": "affected",
              "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd",
              "versionType": "git"
            },
            {
              "lessThan": "082d2c047b0d305bb0b6e9f9d671a09470e2db2d",
              "status": "affected",
              "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd",
              "versionType": "git"
            },
            {
              "lessThan": "b7a78a8adaa8849c02f174d707aead0f85dca0da",
              "status": "affected",
              "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/ti-tsc2046.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.26",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.12",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: tsc2046: fix memory corruption by preventing array overflow\n\nOn one side we have indio_dev-\u003enum_channels includes all physical channels +\ntimestamp channel. On other side we have an array allocated only for\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\nnum_channels variable.\n\nNote the first case is a cleanup rather than a fix as the software\ntimestamp channel bit in active_scanmask is never set by the IIO core."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is in the TI TSC2046 SPI ADC/touchscreen IIO driver and is reached on local driver probe / subsequent local IIO buffer use, not via network or adjacent-network protocols.\nAC:L - The out-of-bounds access occurs deterministically whenever the driver probes with the vulnerable loop bound; no special race or attacker-uncontrollable state is required to hit the memory corruption.\nPR:L - Exploitation is in the context of a local unprivileged user on devices that expose this touchscreen/ADC (embedded/industrial/Android-class systems), without needing full root/init-namespace admin solely to benefit from the kernel corruption.\nUI:N - No separate victim action is required; the bad indexing runs during driver setup, and buffer enablement is performed by the attacker\u2019s own local process.\nS:U - Impact stays within the host kernel\u2019s authority (local memory corruption / privilege impact); it does not cross a VM, IOMMU, or other explicit security boundary.\nC:H - The bug is an out-of-bounds write/read against kernel memory (layout array overflow and read past ch_cfg into adjacent slab), which can be leveraged for information disclosure primitives under the kernel memory-corruption model.\nI:H - Out-of-bounds writes into adjacent private-state/heap (and potential undersized SPI TX/RX buffers used later) are integrity-impacting memory corruption that can support control-flow hijacking.\nA:H - Kernel out-of-bounds memory corruption in this path can oops/panic or otherwise hard-fail the kernel, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:58.053Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0cb9b2f73c182d242a640e512f4785c7c504512f"
        },
        {
          "url": "https://git.kernel.org/stable/c/082d2c047b0d305bb0b6e9f9d671a09470e2db2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7a78a8adaa8849c02f174d707aead0f85dca0da"
        }
      ],
      "title": "iio: adc: tsc2046: fix memory corruption by preventing array overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48927",
    "datePublished": "2024-08-22T03:31:19.861Z",
    "dateReserved": "2024-08-21T06:06:23.298Z",
    "dateUpdated": "2026-08-05T08:52:58.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48927",
      "date": "2026-08-06",
      "epss": "0.00218",
      "percentile": "0.12297"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.14\", \"versionEndExcluding\": \"5.15.26\", \"matchCriteriaId\": \"C4549DFF-A0BC-4C08-B874-F0090921E478\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"5.16.12\", \"matchCriteriaId\": \"C76BAB21-7F23-4AD8-A25F-CA7B262A2698\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niio: adc: tsc2046: fix memory corruption by preventing array overflow\\n\\nOn one side we have indio_dev-\u003enum_channels includes all physical channels +\\ntimestamp channel. On other side we have an array allocated only for\\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\\nnum_channels variable.\\n\\nNote the first case is a cleanup rather than a fix as the software\\ntimestamp channel bit in active_scanmask is never set by the IIO core.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: adc: tsc2046: corrige la corrupci\\u00f3n de la memoria evitando el desbordamiento de la matriz. Por un lado tenemos indio_dev-\u0026gt;num_channels incluye todos los canales f\\u00edsicos + canal de marca de tiempo. Del otro lado tenemos un array asignado s\\u00f3lo para canales f\\u00edsicos. Por lo tanto, corrija la corrupci\\u00f3n de la memoria con ARRAY_SIZE() en lugar de la variable num_channels. Tenga en cuenta que el primer caso es una limpieza en lugar de una soluci\\u00f3n, ya que el n\\u00facleo IIO nunca establece el bit del canal de marca de tiempo del software en active_scanmask.\"}]",
      "id": "CVE-2022-48927",
      "lastModified": "2024-08-23T02:05:45.170",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-08-22T04:15:15.530",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/082d2c047b0d305bb0b6e9f9d671a09470e2db2d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0cb9b2f73c182d242a640e512f4785c7c504512f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b7a78a8adaa8849c02f174d707aead0f85dca0da\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48927\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-22T04:15:15.530\",\"lastModified\":\"2026-08-04T10:17:26.927\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niio: adc: tsc2046: fix memory corruption by preventing array overflow\\n\\nOn one side we have indio_dev-\u003enum_channels includes all physical channels +\\ntimestamp channel. On other side we have an array allocated only for\\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\\nnum_channels variable.\\n\\nNote the first case is a cleanup rather than a fix as the software\\ntimestamp channel bit in active_scanmask is never set by the IIO core.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: adc: tsc2046: corrige la corrupci\u00f3n de la memoria evitando el desbordamiento de la matriz. Por un lado tenemos indio_dev-\u0026gt;num_channels incluye todos los canales f\u00edsicos + canal de marca de tiempo. Del otro lado tenemos un array asignado s\u00f3lo para canales f\u00edsicos. Por lo tanto, corrija la corrupci\u00f3n de la memoria con ARRAY_SIZE() en lugar de la variable num_channels. Tenga en cuenta que el primer caso es una limpieza en lugar de una soluci\u00f3n, ya que el n\u00facleo IIO nunca establece el bit del canal de marca de tiempo del software en active_scanmask.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iio/adc/ti-tsc2046.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9374e8f5a38defe90bc65b2decf317c1c62d91dd\",\"lessThan\":\"0cb9b2f73c182d242a640e512f4785c7c504512f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9374e8f5a38defe90bc65b2decf317c1c62d91dd\",\"lessThan\":\"082d2c047b0d305bb0b6e9f9d671a09470e2db2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9374e8f5a38defe90bc65b2decf317c1c62d91dd\",\"lessThan\":\"b7a78a8adaa8849c02f174d707aead0f85dca0da\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iio/adc/ti-tsc2046.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.26\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.12\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T15:33:02.652045Z\",\"id\":\"CVE-2022-48927\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.26\",\"matchCriteriaId\":\"C4549DFF-A0BC-4C08-B874-F0090921E478\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.12\",\"matchCriteriaId\":\"C76BAB21-7F23-4AD8-A25F-CA7B262A2698\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/082d2c047b0d305bb0b6e9f9d671a09470e2db2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0cb9b2f73c182d242a640e512f4785c7c504512f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7a78a8adaa8849c02f174d707aead0f85dca0da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-04T13:46:36+00:00",
      "cve": "CVE-2022-48927",
      "id": "CVE-2022-48927",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iio: adc: tsc2046: fix memory corruption by preventing array overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48927.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:16:29Z",
      "cve": "CVE-2022-48927",
      "id": "CVE-2022-48927",
      "initial_release_date": "2024-08-23T02:53:35Z",
      "product_status:known_affected": "310",
      "product_status:known_not_affected": "195",
      "product_status:recommended": "411",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48927",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48927.json",
      "version": "49"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48927\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:33:02.652045Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.682Z\"}}], \"cna\": {\"title\": \"iio: adc: tsc2046: fix memory corruption by preventing array overflow\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The overflow is in the TI TSC2046 SPI ADC/touchscreen IIO driver and is reached on local driver probe / subsequent local IIO buffer use, not via network or adjacent-network protocols.\\nAC:L - The out-of-bounds access occurs deterministically whenever the driver probes with the vulnerable loop bound; no special race or attacker-uncontrollable state is required to hit the memory corruption.\\nPR:L - Exploitation is in the context of a local unprivileged user on devices that expose this touchscreen/ADC (embedded/industrial/Android-class systems), without needing full root/init-namespace admin solely to benefit from the kernel corruption.\\nUI:N - No separate victim action is required; the bad indexing runs during driver setup, and buffer enablement is performed by the attacker\\u2019s own local process.\\nS:U - Impact stays within the host kernel\\u2019s authority (local memory corruption / privilege impact); it does not cross a VM, IOMMU, or other explicit security boundary.\\nC:H - The bug is an out-of-bounds write/read against kernel memory (layout array overflow and read past ch_cfg into adjacent slab), which can be leveraged for information disclosure primitives under the kernel memory-corruption model.\\nI:H - Out-of-bounds writes into adjacent private-state/heap (and potential undersized SPI TX/RX buffers used later) are integrity-impacting memory corruption that can support control-flow hijacking.\\nA:H - Kernel out-of-bounds memory corruption in this path can oops/panic or otherwise hard-fail the kernel, so availability impact is high.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9374e8f5a38defe90bc65b2decf317c1c62d91dd\", \"lessThan\": \"0cb9b2f73c182d242a640e512f4785c7c504512f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9374e8f5a38defe90bc65b2decf317c1c62d91dd\", \"lessThan\": \"082d2c047b0d305bb0b6e9f9d671a09470e2db2d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9374e8f5a38defe90bc65b2decf317c1c62d91dd\", \"lessThan\": \"b7a78a8adaa8849c02f174d707aead0f85dca0da\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/iio/adc/ti-tsc2046.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/iio/adc/ti-tsc2046.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0cb9b2f73c182d242a640e512f4785c7c504512f\"}, {\"url\": \"https://git.kernel.org/stable/c/082d2c047b0d305bb0b6e9f9d671a09470e2db2d\"}, {\"url\": \"https://git.kernel.org/stable/c/b7a78a8adaa8849c02f174d707aead0f85dca0da\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niio: adc: tsc2046: fix memory corruption by preventing array overflow\\n\\nOn one side we have indio_dev-\u003enum_channels includes all physical channels +\\ntimestamp channel. On other side we have an array allocated only for\\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\\nnum_channels variable.\\n\\nNote the first case is a cleanup rather than a fix as the software\\ntimestamp channel bit in active_scanmask is never set by the IIO core.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.26\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.12\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:52:58.053Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48927\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:52:58.053Z\", \"dateReserved\": \"2024-08-21T06:06:23.298Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-22T03:31:19.861Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.