CVE-2022-48702

A flaw was found in the Advanced Linux Sound Architecture (ALSA) emu10k1 driver within the Linux kernel. When allocating audio channels, the voice allocation logic fails to account for index wraparound near the end of the voice array in the snd_emu10k1_pcm_channel_alloc() function. A local user can exploit this vulnerability by initiating audio playback that requests multiple channels, triggering an out-of-bounds memory access. This flaw primarily results in a system crash, causing a Denial of Service (DoS), or potential memory corruption.

Red Hat has rated this vulnerability as having a Low impact because exploitation requires local access and the presence of legacy Creative Sound Blaster PCI hardware that is uncommon in enterprise deployments. An authenticated local user with access to audio device nodes could trigger an out-of-bounds condition during multi-channel playback, leading to a kernel crash and denial of service. Standard enterprise installations and cloud environments do not deploy this physical sound card, significantly limiting the real-world exposure of this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.