CVE-2022-50049

ASoC: DPCM: Don't pick up BE without substream

published June 18, 2025

CVSS
—
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ASoC: DPCM: Don't pick up BE without substream

When DPCM tries to add valid BE connections at dpcm_add_paths(), it

doesn't check whether the picked BE actually supports for the given

stream direction. Due to that, when an asymmetric BE stream is

present, it picks up wrongly and this may result in a NULL dereference

at a later point where the code assumes the existence of a

corresponding BE substream.

This patch adds the check for the presence of the substream for the

target BE for avoiding the problem above.

Note that we have already some fix for non-existing BE substream at

commit 6246f283d5e0 ("ASoC: dpcm: skip missing substream while

applying symmetry"). But the code path we've hit recently is rather

happening before the previous fix. So this patch tries to fix at

picking up a BE instead of parsing BE lists.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00191 · 8.3th percentile
Published
2025-06-18T11:01Z
EPSS history
Timeline
  • 18 JUN 11:01Z
    ASoC: DPCM: Don't pick up BE without substream
    cvelistv5