CVE-2022-49478

media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init

Syzbot reported that -1 is used as array index. The problem was in missing validation check.

hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that.

hdw->workpoll initialization moved upper to prevent warning in __flush_work.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-129 Improper Validation of Array Index

Affected Products

Product	Versions
LinuxLinux	d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 4351bfe36aba9fa7dc9d68d498d25d41a0f45e67Affected d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 2e004fe914b243db41fa96f9e583385f360ea58eAffected d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before a3660e06675bccec4bf149c7229ea1d491ba10d7Affected d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 1310fc3538dcc375a2f46ef0a438512c2ca32827Affected d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before a3304766d9384886e6d3092c776273526947a2e9Affected d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 3309c2c574e13b21b44729f5bdbf21f60189b79aAffected d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before f99a8b1ec0eddc2931aeaa4f490277a15b39f511Affected d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 24e807541e4a9263ed928e6ae3498de3ad43bd1eAffected d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 471bec68457aaf981add77b4f590d65dd7da1059Affected
LinuxLinux	2.6.18Affected before 2.6.18Not affected 4.9.318 through 4.9.Not affected 4.14.283 through 4.14.Not affected 4.19.247 through 4.19.Not affected 5.4.198 through 5.4.Not affected 5.10.121 through 5.10.Not affected 5.15.46 through 5.15.Not affected 5.17.14 through 5.17.Not affected 5.18.3 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 4351bfe36aba9fa7dc9d68d498d25d41a0f45e67Affected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 2e004fe914b243db41fa96f9e583385f360ea58eAffected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before a3660e06675bccec4bf149c7229ea1d491ba10d7Affected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 1310fc3538dcc375a2f46ef0a438512c2ca32827Affected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before a3304766d9384886e6d3092c776273526947a2e9Affected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 3309c2c574e13b21b44729f5bdbf21f60189b79aAffected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before f99a8b1ec0eddc2931aeaa4f490277a15b39f511Affected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 24e807541e4a9263ed928e6ae3498de3ad43bd1eAffected
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba to before 471bec68457aaf981add77b4f590d65dd7da1059Affected

LinuxLinux

2.6.18Affected
before 2.6.18Not affected
4.9.318 through 4.9.*Not affected
4.14.283 through 4.14.*Not affected
4.19.247 through 4.19.*Not affected
5.4.198 through 5.4.*Not affected
5.10.121 through 5.10.*Not affected
5.15.46 through 5.15.*Not affected
5.17.14 through 5.17.*Not affected
5.18.3 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.