Security readout for executives and security teams
Plain-English summary
CVE-2022-50773 is a Linux kernel bug in the ALSA MTS-64 driver. Under the reported test condition, loading the driver can trigger a NULL pointer dereference in an interrupt handler and cause a kernel panic. Business impact is mainly availability risk on systems with this uncommon sound/MIDI driver enabled or loadable.
Executive priority
Treat as a targeted availability issue, not a broad enterprise emergency. Patch through normal kernel maintenance, with higher priority for systems using legacy parallel-port MIDI/audio hardware or allowing this module to load.
Technical view
The issue is in snd_mts64_interrupt in the Linux kernel ALSA mts64 driver. During module probing, an interrupt can occur before the mts structure is initialized, leading to a NULL pointer dereference and panic. Upstream stable fixes add a check for mts. CVSS and CWE data are not provided in the source bundle.
Likely exposure
Exposure appears limited to Linux systems with CONFIG_SND_MTS64 available, alongside parport support. The source demonstrates failure during repeated module loading in QEMU. Systems without this driver built or loadable are less likely exposed. Distribution-specific affected package ranges are not provided.
Exploitation context
No active exploitation is indicated; the CVE is not marked KEV in the provided data. The public description shows a reproducible local crash scenario involving module loading. The source does not establish remote exploitability, privilege requirements beyond module interaction, or broader exploit availability.
Researcher notes
Affected version metadata is incomplete and commit-oriented. The source lists multiple stable commits and affected Linux versions, but no CVSS score. Analysis should focus on driver reachability, module autoload policy, and whether vendor kernels have backported the specific mts initialization check.
Mitigation direction
- Update to a vendor kernel containing the upstream ALSA mts64 NULL pointer fix.
- If unused, disable or avoid loading the snd-mts64 driver.
- Follow Linux distribution advisories for backported kernel package fixes.
- Prioritize systems where snd-mts64 and parport modules are enabled or loadable.
Validation and detection
- Inventory kernels for CONFIG_SND_MTS64 and parport support.
- Confirm vendor kernel changelog includes the snd_mts64_interrupt NULL pointer fix.
- Check whether snd-mts64 is loaded or permitted by policy.
- Validate that deployed kernel versions include the relevant upstream stable commit.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 06ec592389f2
- Linux stable commit b471fe61da52
- Linux stable commit 7e91667db38a
- Linux stable commit c7e9624d90bf
- Linux stable commit 064912935921
- Linux stable commit cba633b24a98
- Linux stable commit 1a763c748acd
- Linux stable commit 250eed7b9994
- Linux stable commit cf2ea3c86ad9
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50773 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/06ec592389f2be3199779ab823c4323dcfd2121fCVE reference
- https://git.kernel.org/stable/c/b471fe61da523a15e4cb60fa81f5a2377e4bad98CVE reference
- https://git.kernel.org/stable/c/7e91667db38abb056da5a496d40fbd044c66bed2CVE reference
- https://git.kernel.org/stable/c/c7e9624d90bf20f1eed6b228949396d614b94020CVE reference
- https://git.kernel.org/stable/c/0649129359219ce6ff380ec401f87308485c6ae3CVE reference
- https://git.kernel.org/stable/c/cba633b24a98d957e8190ef8bc4d4cdb4f6e9313CVE reference
- https://git.kernel.org/stable/c/1a763c748acd5540ccc43306c57c9c6c5fb60884CVE reference
- https://git.kernel.org/stable/c/250eed7b9994d79f9c409f954dbd08e88f5afd83CVE reference
- https://git.kernel.org/stable/c/cf2ea3c86ad90d63d1c572b43e1ca9276b0357adCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.