CVE-2022-49288 ALSA: pcm: Fix races among concurrent prealloc proc writes
A race condition in the Linux kernel ALSA PCM driver allows concurrent proc writes to trigger a use-after-free, potentially enabling local privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49288?
CVE-2022-49288 is a high-severity use after free vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Fix races among concurrent prealloc proc writes
We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some weird problem. This patch applies the PCM open_mutex to the proc write operation for avoiding the racy proc writes and the PCM stream open (and further operations).
Weakness: CWE-416
Which versions are affected by CVE-2022-49288?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49288?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-49288 being exploited?
There is no known exploitation of CVE-2022-49288 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49288, GHSA-87qr-3hp3-x583, UBUNTU-CVE-2022-49288.