CVE-2022-48716

ASoC: codecs: wcd938x: fix incorrect used of portid

State: Published
Severity: 7.8 High
Published: Jun 20, 2024
Updated: Aug 5, 2026
Reserved: Jun 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd938x: fix incorrect used of portid

Mixer controls have the channel id in mixer->reg, which is not same as port id. port id should be derived from chan_info array. So fix this. Without this, its possible that we could corrupt struct wcd938x_sdw_priv by accessing port_map array out of range with channel id instead of port id.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
LinuxLinux	e8ba1e05bdc016700c85fad559a812c2e795442f to before aa7152f9f117b3e66b3c0d4158ca4c6d46ab229fAffected e8ba1e05bdc016700c85fad559a812c2e795442f to before 9167f2712dc8c24964840a4d1e2ebf130e846b95Affected e8ba1e05bdc016700c85fad559a812c2e795442f to before c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7Affected
LinuxLinux	5.14Affected before 5.14Not affected 5.15.22 through 5.15.Not affected 5.16.8 through 5.16.Not affected 5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.