CVE-2022-49272: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
Vulnerability summary
CVE-2022-49272 is a medium (CVSS 5.5) Improper Locking vulnerability in linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 10.4% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 9Timeline
- 26-02-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock. A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now. This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.20% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu77 products
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
- linux-aws-5.19All versions (No fix recorded)
Linux2 products
- linux≥ 73867cb2bc7dfa7fbd219e53a0b68d253d8fda09, < 7e9133607e1501c94881be35e118d8f84d96dcb4 | ≥ b3830197aa7413c65767cf5a1aa8775c83f0dbf7, < 40f4cffbe13a51faf136faf5f9ef6847782cd595 | ≥ 08d1807f097a63ea00a7067dad89c1c81cb2115e, < 9661bf674d6a82b76e4ae424438a8ce1e3ed855d | ≥ 8527c8f052fb42091c6569cb928e472376a4a889, < 9017201e8d8c6d1472273361389ed431188584a0 | ≥ 47711ff10c7e126702cfa725f6d86ef529d15a5f, < 7777744e92a0b30e3e0cce2758d911837011ebd9 | ≥ 4d1b0ace2d56dc27cc4921eda7fae57f77f03eb5, < abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e | ≥ dd2f8c684da3e226e5ec7a81c89ff5fd4a957a03, < be9813ad2fc8f0885f5ce6925af0d993ce5da4e5 | ≥ dca947d4d26dbf925a64a6cfb2ddbc035e831a3d, < bc55cfd5718c7c23e5524582e9fa70b4d10f2433 | ≥ 5.10.109, < 5.10.110 | ≥ 5.15.32, < 5.15.33 | ≥ 5.16.18, < 5.16.19 | ≥ 5.17.1, < 5.17.2
- linux_kernelEOL5.10.109 | 5.15.32 | 5.16.18 | 5.17.1
Debian1 product
- linux< 5.17.3-1
3 vendors · 80 products
