CVE-2022-48951: ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
Vulnerability summary
CVE-2022-48951 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15.8% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 21-10-2024PublishedVulnerability first disclosed.
- 23-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu114 products
- linuxAll versions (No fix recorded) | < 4.15.0-208.220 | < 5.4.0-144.161 | < 5.15.0-67.74
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 4.15.0-1153.166 | < 5.4.0-1097.105 | < 5.15.0-1031.35
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 9e5c40b5706d8aae2cf70bd7e01f0b4575a642d0, < 56288987843c3cb343e81e5fa51549cbaf541bd0 | ≥ 4977491e4b3aad8567f57e2a9992d251410c1db3, < cf1c225f1927891ae388562b78ced7840c3723b9 | ≥ 9a12fcbf3c622f9bf6b110a873d62b0cba93972e, < 18a168d85eadcfd45f015b5ecd2a97801b959e43 | ≥ c33402b056de61104b6146dedbe138ca8d7ec62b, < 9796d07c753164b7e6b0d7ef23fb4482840a9ef8 | ≥ 038f8b7caa74d29e020949a43ca368c93f6b29b9, < 50b5f6d4d9d2d69a7498c44fd8b26e13d73d3d98 | ≥ e8e07c5e25a29e2a6f119fd947f55d7a55eb8a13, < cf611d786796ec33da09d8c83d7d7f4e557b27de | ≥ 4f1e50d6a9cf9c1b8c859d449b5031cacfa8404e, < 1798b62d642e7b3d4ea3403914c3caf4e438465d | ≥ 4f1e50d6a9cf9c1b8c859d449b5031cacfa8404e, < 97eea946b93961fffd29448dcda7398d0d51c4b2 | ef6cd9eeb38062a145802b7b56be7ae1090e165e | ≥ 4.9.300, < 4.9.337 | ≥ 4.14.265, < 4.14.303 | ≥ 4.19.228, < 4.19.270 | ≥ 5.4.178, < 5.4.228 | ≥ 5.10.99, < 5.10.160 | ≥ 5.15.22, < 5.15.84 | ≥ 5.16.8, < 5.17 | 5.17
- linux_kernel< 4.9.337 | ≥ 4.10, < 4.14.303 | ≥ 4.15, < 4.19.270 | ≥ 4.20, < 5.4.228 | ≥ 5.5, < 5.10.160 | ≥ 5.11, < 5.15.84 | ≥ 5.16, < 6.0.14 | 6.1:rc1 | 6.1:rc2 | 6.1:rc3 | 6.1:rc4 | 6.1:rc5 | 6.1:rc6 | 6.1:rc7 | 6.1:rc8
Debian1 product
- linux< 6.1.4-1
3 vendors · 117 products
