CVE-2022-48701: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-03 · updated 2026-06-17
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces.

Affected products

Linux kernel: before 4.9.328; from 4.10 before 4.14.293; from 4.15 before 4.19.258; from 4.20 before 5.4.213; from 5.5 before 5.10.143; from 5.11 before 5.15.68 — fixed in 4.14.293, 4.19.258, 4.9.328, 5.10.143, 5.15.68, 5.19.9

How to fix

Upgrade to a fixed version: Linux kernel 4.14.293, 4.19.258, 4.9.328, 5.10.143. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-48701 or the next vulnerability affects your stack