PT-2024-8441 · Linux+4 · Linux Kernel+4

Published 2022-08-18 · Updated 2025-09-29 · CVE-2022-48696

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the regmap component in the Linux kernel, specifically with the spi module. The max raw read and max raw write limits in the regmap spi struct do not account for the additional size of the transmitted register address and padding, potentially exceeding the maximum permitted SPI message size and causing undefined behavior, such as data corruption. The function regmap get spi bus() has been fixed to properly adjust these limits by reserving space for the register address and padding as set in the regmap configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

ALSA-2025_16880

BDU:2024-10000

CESA-2023_2951

CVE-2022-48696

RHSA-2023:2458

RHSA-2023:2951

RHSA-2023_2458

RHSA-2023_2951

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Red Os

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48696.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-48696 · Security Note
• https://git.kernel.org/stable/c/15ff1f17847c19174b260bd7dd0de33edcebd45e · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-48696 · Vendor Advisory
• https://git.kernel.org/stable/c/f5723cfc01932c7a8d5c78dbf7e067e537c91439 · Patch
• https://osv.dev/vulnerability/CVE-2022-48696 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10000 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-48696 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48696 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48696 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48696 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2024050348-CVE-2022-48696-b671@gregkh/T · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://access.redhat.com/security/cve/CVE-2022-48696 · Note
• https://t.me/cvenotify/79219 · Telegram Post