PT-2025-18489 · Linux+2 · Linux Kernel+2

Published 2022-11-12 · Updated 2025-07-10 · CVE-2022-49772

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel related to the ALSA: usb-audio component. The issue concerns the snd usbmidi output open() function, which contains a check for a NULL port using snd BUG ON(). However, this check can be triggered when a device provides an invalid endpoint setup in its descriptor, causing the driver to skip allocation. The check itself is valid, but the use of snd BUG ON() can be misleading, suggesting a real bug. This was recently detected by syzbot.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Improper Resource Release

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-404

CWE-770

Related Identifiers

BDU:2026-02634

CVE-2022-49772

SUSE-SU-2025:01918-1

SUSE-SU-2025:01966-1

SUSE-SU-2025:01982-1

SUSE-SU-2025:01983-1

SUSE-SU-2025:01995-1

SUSE-SU-2025:02173-1

SUSE-SU-2025:02262-1

SUSE-SU-2025:2173-1

SUSE-SU-2025_01982-1

SUSE-SU-2025_01983-1

SUSE-SU-2025_02173-1

SUSE-SU-2025_02262-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 755

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49772.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49772 · Vendor Advisory
• https://git.kernel.org/stable/c/368a01e5064c13946d032ab1d65ba95020a39cc5 · Patch
• https://ubuntu.com/security/CVE-2022-49772 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49772 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49772 · Vendor Advisory
• https://git.kernel.org/stable/c/a80369c8ca50bc885d14386087a834659ec54a54 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:01982-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02634 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49772 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01983-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02173-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49772 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01966-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02262-1 · Vendor Advisory