CVE-2022-50049: ASoC: DPCM: Don't pick up BE without substream
In the Linux kernel, the following vulnerability has been resolved:
ASoC: DPCM: Don't pick up BE without substream
When DPCM tries to add valid BE connections at dpcm_add_paths(), it
doesn't check whether the picked BE actually supports for the given
stream direction. Due to that, when an asymmetric BE stream is
present, it picks up wrongly and this may result in a NULL dereference
at a later point where the code assumes the existence of a
corresponding BE substream.
This patch adds the check for the presence of the substream for the
target BE for avoiding the problem above.
Note that we have already some fix for non-existing BE substream at
commit 6246f283d5e0 ("ASoC: dpcm: skip missing substream while
applying symmetry"). But the code path we've hit recently is rather
happening before the previous fix. So this patch tries to fix at
picking up a BE instead of parsing BE lists.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can cause a NULL pointer dereference in the ASoC DPCM audio subsystem when certain asymmetric audio back-end streams are evaluated. For executives, the likely business impact is service instability on affected Linux or embedded devices, not confirmed data theft or remote compromise based on the provided sources.
Executive priority
Treat as targeted remediation for Linux and embedded assets using affected audio paths. It does not justify emergency enterprise-wide response from the supplied evidence, but device manufacturers and kernel owners should confirm patch status.
Technical view
dpcm_add_paths() could select a back-end DAI connection without confirming that the BE has a substream for the requested stream direction. Later code assumes that substream exists, which can lead to a NULL dereference. The fix adds a substream presence check before selecting the BE.
Likely exposure
Exposure appears limited to Linux kernels using the ASoC DPCM audio path, especially asymmetric BE stream configurations. The bundle lists Linux as affected, but does not provide distro package mappings, device models, or complete version range semantics.
Exploitation context
The provided bundle does not cite public exploitation, exploit code, or KEV listing. It describes a kernel NULL dereference reachable through a specific audio subsystem code path, but does not establish attacker prerequisites or remote reachability.
Researcher notes
The source evidence is sparse: no CVSS, CWE, exploit status, or distro mapping is provided. Analysis should focus on the referenced stable commits and whether local kernel builds include the substream check in dpcm_add_paths().
Mitigation direction
Check Linux vendor or distribution advisories for fixed kernel packages.
Prioritize kernels containing the referenced stable fixes.
Update affected Linux kernels through normal vendor channels.
For embedded fleets, ask OEMs whether ASoC DPCM is used.
Track this as availability risk unless new evidence emerges.
Validation and detection
Inventory Linux kernel versions across servers, appliances, and embedded devices.
Identify devices using ASoC DPCM audio configurations.
Compare deployed kernels against vendor-fixed releases or referenced commits.
Review kernel logs for NULL dereference crashes in ASoC DPCM paths.
Confirm no unsupported custom kernel trees remain exposed.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-50049 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
4Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Jun 18, 2025, 11:01 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.