CVE-2022-48716

What it actually does

Incorrect use of channel id from mixer->reg as port id instead of deriving from chan_info causes out-of-bounds access into port_map array, corrupting the wcd938x_sdw_priv structure in the Linux kernel ASoC wcd938x codec driver.

Why it matters to the business

Critical memory corruption in widely deployed Linux kernels (including Android) creates potential for remote code execution or denial of service; although EPSS remains low and the issue is not on CISA KEV, the nine-plus-month-old flaw still requires urgent patching across server, desktop, and mobile fleets due to high CVSS and Android kernel exploitation interest.

How an attack unfolds

An attacker sends crafted mixer control values that place a malicious channel id into reg; the driver treats this as a port id, indexes port_map out of bounds, and corrupts wcd938x_sdw_priv, enabling memory corruption that can be leveraged for remote code execution. Named Android kernel RCE threat actors have shown interest in similar kernel audio paths.

How to fix it

Upgrade the Linux kernel to commit aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f or later stable releases that contain the fix; rebuild and deploy the patched kernel across all affected distributions and Android devices.

How to confirm the fix worked

Confirm the running kernel contains commit aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f via git log or kernel version string; review wcd938x driver source to verify port id is now derived exclusively from chan_info; test mixer controls with boundary channel ids to ensure no out-of-range accesses occur.

Typical attack path

1. Identify Linux kernel systems exposing ASoC wcd938x mixer controls (local or via exposed audio interfaces)
2. Craft and submit malicious mixer control values containing an out-of-range channel id
3. Trigger the portid derivation path that indexes port_map with the channel id
4. Corrupt wcd938x_sdw_priv structure to achieve memory write primitives
5. Escalate to kernel code execution or trigger denial of service

How to detect it

Search kernel logs and audit trails for wcd938x driver warnings or oops messages referencing port_map or wcd938x_sdw_priv corruption; inspect audio mixer control submissions from untrusted processes; correlate with Android kernel crash reports involving the wcd938x codec.

• wcd938x_sdw_priv
• port_map
• chan_info
• ASoC wcd938x

What your security team should do

• Immediately prioritize kernel updates containing aa7152f9f117b3e66b3c0d4158ca4c6d46ab229f on all Linux and Android systems
• Monitor upstream stable kernel releases and distribution security advisories for backports
• Restrict untrusted local access to audio mixer controls until patches are applied
• Include kernel audio codec drivers in exploit-mitigation testing (KASAN, etc.)