{
  "threat_severity" : "Low",
  "public_date" : "2025-12-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: Linux kernel ALSA mts64 module: Denial of Service via null pointer dereference",
    "id" : "2425174",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2425174"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-476",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt\nI got a null-ptr-defer error report when I do the following tests\non the qemu platform:\nmake defconfig and CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m,\nCONFIG_SND_MTS64=m\nThen making test scripts:\ncat>test_mod1.sh<<EOF\nmodprobe snd-mts64\nmodprobe snd-mts64\nEOF\nExecuting the script, perhaps several times, we will get a null-ptr-defer\nreport, as follow:\nsyzkaller:~# ./test_mod.sh\nsnd_mts64: probe of snd_mts64.0 failed with error -5\nmodprobe: ERROR: could not insert 'snd_mts64': No such device\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n#PF: supervisor write access in kernel mode\n#PF: error_code(0x0002) - not-present page\nPGD 0 P4D 0\nOops: 0002 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 205 Comm: modprobe Not tainted 6.1.0-rc8-00588-g76dcd734eca2 #6\nCall Trace:\n<IRQ>\nsnd_mts64_interrupt+0x24/0xa0 [snd_mts64]\nparport_irq_handler+0x37/0x50 [parport]\n__handle_irq_event_percpu+0x39/0x190\nhandle_irq_event_percpu+0xa/0x30\nhandle_irq_event+0x2f/0x50\nhandle_edge_irq+0x99/0x1b0\n__common_interrupt+0x5d/0x100\ncommon_interrupt+0xa0/0xc0\n</IRQ>\n<TASK>\nasm_common_interrupt+0x22/0x40\nRIP: 0010:_raw_write_unlock_irqrestore+0x11/0x30\nparport_claim+0xbd/0x230 [parport]\nsnd_mts64_probe+0x14a/0x465 [snd_mts64]\nplatform_probe+0x3f/0xa0\nreally_probe+0x129/0x2c0\n__driver_probe_device+0x6d/0xc0\ndriver_probe_device+0x1a/0xa0\n__device_attach_driver+0x7a/0xb0\nbus_for_each_drv+0x62/0xb0\n__device_attach+0xe4/0x180\nbus_probe_device+0x82/0xa0\ndevice_add+0x550/0x920\nplatform_device_add+0x106/0x220\nsnd_mts64_attach+0x2e/0x80 [snd_mts64]\nport_check+0x14/0x20 [parport]\nbus_for_each_dev+0x6e/0xc0\n__parport_register_driver+0x7c/0xb0 [parport]\nsnd_mts64_module_init+0x31/0x1000 [snd_mts64]\ndo_one_initcall+0x3c/0x1f0\ndo_init_module+0x46/0x1c6\nload_module+0x1d8d/0x1e10\n__do_sys_finit_module+0xa2/0xf0\ndo_syscall_64+0x37/0x90\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\n</TASK>\nKernel panic - not syncing: Fatal exception in interrupt\nRebooting in 1 seconds..\nThe mts wa not initialized during interrupt,  we add check for\nmts to fix this bug.", "A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) mts64 module. A local user can trigger a null pointer dereference in the `snd_mts64_interrupt` function by repeatedly loading and unloading the `snd-mts64` module. This can lead to a kernel panic, resulting in a Denial of Service (DoS) on the system." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-05-16T00:00:00Z",
    "advisory" : "RHSA-2023:2951",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-477.10.1.el8_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-05-09T00:00:00Z",
    "advisory" : "RHSA-2023:2458",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-284.11.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-05-09T00:00:00Z",
    "advisory" : "RHSA-2023:2458",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-284.11.1.el9_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2022-50773\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-50773\nhttps://lore.kernel.org/linux-cve-announce/2025122459-CVE-2022-50773-b946@gregkh/T" ],
  "name" : "CVE-2022-50773",
  "csaw" : false
}