CVE-2022-50049 ASoC: DPCM: Don't pick up BE without substream
A null pointer dereference in the Linux kernel's ASoC DPCM subsystem can cause a system crash when handling asymmetric backend streams.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50049?
CVE-2022-50049 is a medium-severity vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: DPCM: Don't pick up BE without substream
When DPCM tries to add valid BE connections at dpcm_add_paths(), it doesn't check whether the picked BE actually supports for the given stream direction. Due to that, when an asymmetric BE stream is present, it picks up wrongly and this may result in a NULL dereference at a later point where the code assumes the existence of a corresponding BE substream.
This patch adds the check for the presence of the substream for the target BE for avoiding the problem above.
Note that we have already some fix for non-existing BE substream at commit 6246f283d5e0 ("ASoC: dpcm: skip missing substream while applying symmetry"). But the code path we've hit recently is rather happening before the previous fix. So this patch tries to fix at picking up a BE instead of parsing BE lists.
Weakness: CWE-476
Which versions are affected by CVE-2022-50049?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50049?
Apply the vendor's patch.
Is CVE-2022-50049 being exploited?
There is no known exploitation of CVE-2022-50049 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-50049, GHSA-wvhc-gh4m-r3j8, UBUNTU-CVE-2022-50049.