CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-08-04
Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fix PCM OSS buffer allocation overflow We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON(). This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes.

Affected products

Linux kernel: before 4.19.237; from 4.20 before 5.4.188; from 5.5 before 5.10.109; from 5.11 before 5.15.32; from 5.16 before 5.16.18; 5.17 — fixed in 4.19.237, 5.10.109, 5.15.32, 5.16.18, 5.4.188

How to fix

Upgrade to a fixed version: Linux kernel 4.19.237, 5.10.109, 5.15.32, 5.16.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49292 or the next vulnerability affects your stack