Log in Start free

Vulnerability · Published May 1, 2025 · Assigned by Linux

CVE-2022-49772ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 89.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() snd_usbmidi_output_open() has a check of the NULL port with snd_BUG_ON(). snd_BUG_ON() was used as this shouldn't have happened, but in reality, the NULL port may be seen when the device gives an invalid endpoint setup at the descriptor, hence the driver skips the allocation. That is, the check itself is valid and snd_BUG_ON() should be dropped from there. Otherwise it's confusing as if it were a real bug, as recently syzbot stumbled on it.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.10-1DEBIAN-CVE-2022-49772
Debian:13linux6.0.10-1DEBIAN-CVE-2022-49772
Debian:14linux6.0.10-1DEBIAN-CVE-2022-49772
Ubuntu:22.04:LTSlinux5.15.0-67.74UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-aws5.15.0-1031.35UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-azure5.15.0-1034.41UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1034.41.1UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-gcp5.15.0-1030.37UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-gke5.15.0-1028.33UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1016.21UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-ibm5.15.0-1026.29UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1026.31UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-kvm5.15.0-1029.34UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-67.74UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1023.23UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-oracle5.15.0-1030.36UBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-raspi5.15.0-1025.27UBUNTU-CVE-2022-49772
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49772
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49772
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49772

Affected products (as reported)

VendorProductVersions
Linux Linux 738d9edcfd44f154924692e54109fb439fcf8bdd – before c43991065f36f7628cd124e037b8750c4617a7a7738d9edcfd44f154924692e54109fb439fcf8bdd – before e7dc436aea80308a9268e6d2d85f910ff107de9b738d9edcfd44f154924692e54109fb439fcf8bdd – before a80369c8ca50bc885d14386087a834659ec54a54738d9edcfd44f154924692e54109fb439fcf8bdd – before 02b94885b2fdf1808b1874e009bfb90753f8f4db738d9edcfd44f154924692e54109fb439fcf8bdd – before 00f5f1bbf815a39e9eecb468d12ca55d3360eb10738d9edcfd44f154924692e54109fb439fcf8bdd – before ad72c3c3f6eb81d2cb189ec71e888316adada5df
Linux Linux 4.15

References