PT-2025-8448 · Linux+4 · Linux Kernel+4

Hui Wang · Published 2022-04-05 · Updated 2025-09-29 · CVE-2022-49515

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the out-of-bounds access in otp packed element t

Description The issue is related to an out-of-bounds access in the Linux kernel, specifically in the cs35l41 driver. The problem occurs because the CS35L41 NUM OTP ELEM is defined as 100, but only 99 entries are defined in the array otp map 1/2, resulting in a shift-out-of-bounds warning when the last entry in the array is accessed. This warning is reported by UBSAN in the cs35l41 otp unpack function.

Recommendations As a temporary workaround, consider disabling the cs35l41 driver until a patch is available. Update to a Linux kernel version that includes the fix for the out-of-bounds access in otp packed element t.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2025_16880

BDU:2026-03683

CESA-2022_7683

CVE-2022-49515

RHSA-2022:7683

RHSA-2022:8267

RHSA-2022_7683

RHSA-2022_8267

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 1333

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49515.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49515 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49515 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://git.kernel.org/stable/c/dbc35268e14d5d89c7a9db72009ad4dcd9ede646 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49515 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49515 · Security Note
• https://bdu.fstec.ru/vul/2026-03683 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49515 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://git.kernel.org/stable/c/a59b9958416096dd21dc4f62b0c5be525d459ca8 · Patch
• https://git.kernel.org/stable/c/9f342904216f378e88008bb0ce1ae200a4b99fe8 · Patch