Review reviewHigh

CVE-2022-48716

Linux Linux, linux_kernel, linux kernel

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix incorrect used of portid Mixer controls have the channel id in mixer->reg, which is not same as port id. port id should be derived from chan_info array. So fix this. Without this, its possible that we could corrupt struct wcd938x_sdw_priv by accessing port_map array out of range with channel id instead of port id.

CVSS: 7.8
EPSS: 0.46%
CISA KEV: Not listed
Published: 2024.06.20

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.46%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux_kernel, linux kernel
Affected versions: >= e8ba1e05bdc016700c85fad559a812c2e795442f < aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f, >= e8ba1e05bdc016700c85fad559a812c2e795442f < 9167f2712dc8c24964840a4d1e2ebf130e846b95, >= e8ba1e05bdc016700c85fad559a812c2e795442f < c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7, >= 5.14, >= e8ba1e05bdc0 < aa7152f9f117, >= e8ba1e05bdc0 < 9167f2712dc8, >= e8ba1e05bdc0 < c5c1546a654f, >= 5.14 < 5.15.22, >= 5.16 < 5.16.8, 5.17
Fixed versions: 5.15.22, 5.16.8

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux_kernel, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-400