LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50049: ASoC: DPCM: Don't pick up BE without substream

In the Linux kernel, the following vulnerability has been resolved: ASoC: DPCM: Don't pick up BE without substream When DPCM tries to add valid BE connections at dpcm_add_paths(), it doesn't check whether the picked BE actually supports for the given stream direction. Due to that, when an asymmetric BE stream is present, it picks up wrongly and this may result in a NULL dereference at a later point where the code assumes the existence of a corresponding BE substream. This patch adds the check for the presence of the substream for the target BE for avoiding the problem above. Note that we have already some fix for non-existing BE substream at commit 6246f283d5e0 ("ASoC: dpcm: skip missing substream while applying symmetry"). But the code path we've hit recently is rather happening before the previous fix. So this patch tries to fix at picking up a BE instead of parsing BE lists.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can cause a NULL pointer dereference in the ASoC DPCM audio subsystem when certain asymmetric audio back-end streams are evaluated. For executives, the likely business impact is service instability on affected Linux or embedded devices, not confirmed data theft or remote compromise based on the provided sources.

Executive priority

Treat as targeted remediation for Linux and embedded assets using affected audio paths. It does not justify emergency enterprise-wide response from the supplied evidence, but device manufacturers and kernel owners should confirm patch status.

Technical view

dpcm_add_paths() could select a back-end DAI connection without confirming that the BE has a substream for the requested stream direction. Later code assumes that substream exists, which can lead to a NULL dereference. The fix adds a substream presence check before selecting the BE.

Likely exposure

Exposure appears limited to Linux kernels using the ASoC DPCM audio path, especially asymmetric BE stream configurations. The bundle lists Linux as affected, but does not provide distro package mappings, device models, or complete version range semantics.

Exploitation context

The provided bundle does not cite public exploitation, exploit code, or KEV listing. It describes a kernel NULL dereference reachable through a specific audio subsystem code path, but does not establish attacker prerequisites or remote reachability.

Researcher notes

The source evidence is sparse: no CVSS, CWE, exploit status, or distro mapping is provided. Analysis should focus on the referenced stable commits and whether local kernel builds include the substream check in dpcm_add_paths().

Mitigation direction

  • Check Linux vendor or distribution advisories for fixed kernel packages.
  • Prioritize kernels containing the referenced stable fixes.
  • Update affected Linux kernels through normal vendor channels.
  • For embedded fleets, ask OEMs whether ASoC DPCM is used.
  • Track this as availability risk unless new evidence emerges.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded devices.
  • Identify devices using ASoC DPCM audio configurations.
  • Compare deployed kernels against vendor-fixed releases or referenced commits.
  • Review kernel logs for NULL dereference crashes in ASoC DPCM paths.
  • Confirm no unsupported custom kernel trees remain exposed.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50049 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc474bb800000d1a93624f6d060e2bba16edf6820, bbf7d3b1c4f40eb02dd1dffb500ba00b0bff0303, bbf7d3b1c4f40eb02dd1dffb500ba00b0bff0303unaffected
LinuxLinux5.17, 0, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.