CVE-2022-49291

highpriority · track · 0EPSS 0.003 · 23 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.30% (23rd) EPSS
CVSS 7.8 · high
Is it mine?
33 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · suse_csaf

EPSS · scored 2026-10-27

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedkernel-default-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-default-base-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-default-devel-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-ec2-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-ec2-base-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-ec2-devel-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-source-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-syms-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-trace-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-trace-base-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-trace-devel-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-xen-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-xen-base-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-xen-devel-3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-default-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-default-base-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-default-devel-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-docs-0:3.0.101-108.180.1.noarch as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-ec2-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-ec2-base-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-ec2-devel-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-source-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-syms-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-trace-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-trace-base-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-trace-devel-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-xen-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-xen-base-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedkernel-xen-devel-0:3.0.101-108.180.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME COREsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technical severity, 0–10. One row per scoring source.

7.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.8 · impact 5.9
v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17highCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · SUSE Product Security
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-416USCWE-416US
05

affected products (33)

Products and version ranges known to be affected.

showing 20 of 33
06

advisories (2)

Vendor and ecosystem advisories describing this.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bdususe_csafNVDCVE.orgMITRE
published 2025-02-26modified 2026-06-17
09

references (25)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan