CVE-2022-50773

ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt

published December 24, 2025

CVSS
—
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt

I got a null-ptr-defer error report when I do the following tests

on the qemu platform:

make defconfig and CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m,

CONFIG_SND_MTS64=m

Then making test scripts:

cat>test_mod1.sh<<EOF

modprobe snd-mts64

modprobe snd-mts64

EOF

Executing the script, perhaps several times, we will get a null-ptr-defer

report, as follow:

syzkaller:~# ./test_mod.sh

snd_mts64: probe of snd_mts64.0 failed with error -5

modprobe: ERROR: could not insert 'snd_mts64': No such device

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page

PGD 0 P4D 0

Oops: 0002 [#1] PREEMPT SMP PTI

CPU: 0 PID: 205 Comm: modprobe Not tainted 6.1.0-rc8-00588-g76dcd734eca2 #6

Call Trace:

<IRQ>

snd_mts64_interrupt+0x24/0xa0 [snd_mts64]

parport_irq_handler+0x37/0x50 [parport]

__handle_irq_event_percpu+0x39/0x190

handle_irq_event_percpu+0xa/0x30

handle_irq_event+0x2f/0x50

handle_edge_irq+0x99/0x1b0

__common_interrupt+0x5d/0x100

common_interrupt+0xa0/0xc0

</IRQ>

<TASK>

asm_common_interrupt+0x22/0x40

RIP: 0010:_raw_write_unlock_irqrestore+0x11/0x30

parport_claim+0xbd/0x230 [parport]

snd_mts64_probe+0x14a/0x465 [snd_mts64]

platform_probe+0x3f/0xa0

really_probe+0x129/0x2c0

__driver_probe_device+0x6d/0xc0

driver_probe_device+0x1a/0xa0

__device_attach_driver+0x7a/0xb0

bus_for_each_drv+0x62/0xb0

__device_attach+0xe4/0x180

bus_probe_device+0x82/0xa0

device_add+0x550/0x920

platform_device_add+0x106/0x220

snd_mts64_attach+0x2e/0x80 [snd_mts64]

port_check+0x14/0x20 [parport]

bus_for_each_dev+0x6e/0xc0

__parport_register_driver+0x7c/0xb0 [parport]

snd_mts64_module_init+0x31/0x1000 [snd_mts64]

do_one_initcall+0x3c/0x1f0

do_init_module+0x46/0x1c6

load_module+0x1d8d/0x1e10

__do_sys_finit_module+0xa2/0xf0

do_syscall_64+0x37/0x90

entry_SYSCALL_64_after_hwframe+0x63/0xcd

</TASK>

Kernel panic - not syncing: Fatal exception in interrupt

Rebooting in 1 seconds..

The mts wa not initialized during interrupt, we add check for

mts to fix this bug.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Published
2025-12-24T13:06Z
EPSS history
Timeline
  • 24 DEC 13:06Z
    ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
    cvelistv5