CVE-2022-49498 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Check for null pointer of pointer substream before dereferencing it Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned.
A vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) component allows for a null pointer dereference in the PCM (Pulse Code Modulation) subsystem. The issue arises because the pointer to the substream is dereferenced before it is checked for nullity, leading to potential instability. Although the PCM_RUNTIME_CHECK macro calls BUG_ON to handle such cases, it is still necessary to perform a pointer check before assigning the card pointer.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/011b559be832194f992f73d6c0d5485f5925a10b | kernel.org | Patch |
| https://git.kernel.org/stable/c/1f2e28857be1e5c7db39bbc221332215fc5467e3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7784d22f81a29df2ec57ca90d54f93a35cbcd1a2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b2421a196cb0911ea95aec1050a0b830464c8fa6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b41ef7ad9238c22aa2e142f5ce4ce1a1a0d48123 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f2c68c52898f623fe84518da4606538d193b0cca | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.6, < 5.10.121 >= 5.11, < 5.15.46 >= 5.16, < 5.17.14 >= 5.18, < 5.18.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 1, 2025 | CVE Modified | CISA-ADP |
| Mar 17, 2025 | Initial Analysis | [email protected] |
| Feb 26, 2025 | New CVE Received | kernel.org |