PT-2025-8220 · Linux+4 · Linux Kernel+4

Syzbot · Published 2022-03-18 · Updated 2025-09-29 · CVE-2022-49292

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A buffer allocation overflow issue has been identified in the Linux kernel, specifically in the ALSA oss PCM OSS layer. The problem occurs when the size of a temporary buffer for data conversion becomes unexpectedly large due to more channels or higher rates, potentially exceeding INT MAX and triggering a WARN ON(). The issue arises because the restrictions on input parameters are based solely on the hw params of the underlying PCM device. To address this, a patch has been implemented to add a limit of 1MB as the upper bound for period bytes and to perform size checks at two critical points.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Memory Corruption

Weakness Enumeration

CWE-770

CWE-787

Related Identifiers

ALSA-2025_16880

BDU:2026-01501

CESA-2022_7683

CVE-2022-49292

OESA-2025-1336

OPENSUSE-SU-2025_1263-1

RHSA-2022:7683

RHSA-2022:8267

RHSA-2022_7683

RHSA-2022_8267

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1194-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1263-1

SUSE-SU-2025:1293-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1263-1

SUSE-SU-2025_1293-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 1524

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49292.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-49292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49350 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49243 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49335 · Security Note
• https://git.kernel.org/stable/c/5ce74ff7059341d8b2f4d01c3383491df63d1898 · Patch
• https://git.kernel.org/stable/c/7a40cbf3579a8e14849ba7ce46309c1992658d2b · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49381 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49292 · Vendor Advisory
• https://git.kernel.org/stable/c/fb08bf99195a87c798bc8ae1357337a981faeade · Patch
• https://git.kernel.org/stable/c/efb6402c3c4a7c26d97c92d70186424097b6e366 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49490 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1293-1 · Vendor Advisory