CVE-2022-48739

What it actually does

The vulnerability allows out-of-bounds slab read accesses via memcpy in the hdmi-codec driver due to incorrect sizing of the iec_status array relative to struct snd_aes_iec958.

Why it matters to the business

Affected Linux kernel deployments, including downstream Android and embedded systems with HDMI audio, face low-probability crashes or memory disclosure after 849 days with stable 0.00233 EPSS and no ransomware or KEV usage.

How an attack unfolds

An attacker triggers the hdmi-codec driver with crafted IEC958 status data during audio operations to cause memcpy to read past the undersized iec_status array; no confirmed exploitation by listed threat actors despite Android kernel references.

How to fix it

Upgrade the Linux kernel to include commit 10007bd96b6c4c3cfaea9e76c311b06a07a5e260 from the stable repository.

How to confirm the fix worked

Confirm the iec_status array declaration matches the size of the status array in struct snd_aes_iec958 and run KASAN-enabled tests showing no slab read violations in hdmi-codec.

Typical attack path

1. Locate a target system exposing the vulnerable hdmi-codec driver
2. Initiate audio playback or HDMI status update involving snd_aes_iec958 data
3. Supply oversized status causing memcpy to perform OOB slab read

How to detect it

Search kernel logs and KASAN output for out-of-bounds slab read messages originating from hdmi-codec or memcpy involving iec_status or snd_aes_iec958.

What your security team should do

• Apply the referenced kernel commit to all affected stable branches
• Audit usage of the hdmi-codec module across the fleet
• Enable KASAN or similar memory debugging in test environments