CVE-2022-49842

ASoC: core: Fix use-after-free in snd_soc_exit()

State: Published
Severity: 7.8 High
Published: May 1, 2025
Updated: May 11, 2026
Reserved: May 1, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: core: Fix use-after-free in snd_soc_exit()

KASAN reports a use-after-free:

BUG: KASAN: use-after-free in device_del+0xb5b/0xc60 Read of size 8 at addr ffff888008655050 by task rmmod/387 CPU: 2 PID: 387 Comm: rmmod Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dump_stack_lvl+0x79/0x9a print_report+0x17f/0x47b kasan_report+0xbb/0xf0 device_del+0xb5b/0xc60 platform_device_del.part.0+0x24/0x200 platform_device_unregister+0x2e/0x40 snd_soc_exit+0xa/0x22 [snd_soc_core] __do_sys_delete_module.constprop.0+0x34f/0x5b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK>

It's bacause in snd_soc_init(), snd_soc_util_init() is possble to fail, but its ret is ignored, which makes soc_dummy_dev unregistered twice.

snd_soc_init() snd_soc_util_init() platform_device_register_simple(soc_dummy_dev) platform_driver_register() # fail platform_device_unregister(soc_dummy_dev) platform_driver_register() # success ... snd_soc_exit() snd_soc_util_exit() # soc_dummy_dev will be unregistered for second time

To fix it, handle error and stop snd_soc_init() when util_init() fail. Also clean debugfs when util_init() or driver_register() fail.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	fb257897bf20c5f0e1df584bb5b874e811651263 to before 41fad4f712e081acdfde8b59847f9f66eaf407a0Affected fb257897bf20c5f0e1df584bb5b874e811651263 to before 90bbdf30a51e42378cb23a312005a022794b8e1eAffected fb257897bf20c5f0e1df584bb5b874e811651263 to before a3365e62239dc064019a244bde5686ac18527c22Affected fb257897bf20c5f0e1df584bb5b874e811651263 to before 2ec3f558db343b045a7c7419cdbaec266b8ac1a7Affected fb257897bf20c5f0e1df584bb5b874e811651263 to before 8d21554ec7680e9585fb852d933203c3db60dad1Affected fb257897bf20c5f0e1df584bb5b874e811651263 to before 34eee4189bcebbd5f6a2ff25ef0cb893ad33d51eAffected fb257897bf20c5f0e1df584bb5b874e811651263 to before c5674bd073c0fd9f620ca550c5ff08d0d429bdd9Affected fb257897bf20c5f0e1df584bb5b874e811651263 to before 6ec27c53886c8963729885bcf2dd996eba2767a7Affected
LinuxLinux	3.0Affected before 3.0Not affected 4.9.334 through 4.9.Not affected 4.14.300 through 4.14.Not affected 4.19.267 through 4.19.Not affected 5.4.225 through 5.4.Not affected 5.10.156 through 5.10.Not affected 5.15.80 through 5.15.Not affected 6.0.10 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

fb257897bf20c5f0e1df584bb5b874e811651263 to before 41fad4f712e081acdfde8b59847f9f66eaf407a0Affected
fb257897bf20c5f0e1df584bb5b874e811651263 to before 90bbdf30a51e42378cb23a312005a022794b8e1eAffected
fb257897bf20c5f0e1df584bb5b874e811651263 to before a3365e62239dc064019a244bde5686ac18527c22Affected
fb257897bf20c5f0e1df584bb5b874e811651263 to before 2ec3f558db343b045a7c7419cdbaec266b8ac1a7Affected
fb257897bf20c5f0e1df584bb5b874e811651263 to before 8d21554ec7680e9585fb852d933203c3db60dad1Affected
fb257897bf20c5f0e1df584bb5b874e811651263 to before 34eee4189bcebbd5f6a2ff25ef0cb893ad33d51eAffected
fb257897bf20c5f0e1df584bb5b874e811651263 to before c5674bd073c0fd9f620ca550c5ff08d0d429bdd9Affected
fb257897bf20c5f0e1df584bb5b874e811651263 to before 6ec27c53886c8963729885bcf2dd996eba2767a7Affected

LinuxLinux

3.0Affected
before 3.0Not affected
4.9.334 through 4.9.*Not affected
4.14.300 through 4.14.*Not affected
4.19.267 through 4.19.*Not affected
5.4.225 through 5.4.*Not affected
5.10.156 through 5.10.*Not affected
5.15.80 through 5.15.*Not affected
6.0.10 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.