CVE-2022-48994

What it actually does

Function prototype mismatch between snd_seq_dump_func_t and the implementations of seq_copy_in_user() and seq_copy_in_kernel() that triggers kCFI validation failures, resulting in kernel panic or thread termination when CONFIG_CFI_CLANG is enabled.

Why it matters to the business

Systems running affected Linux kernels with Clang CFI may experience unexpected crashes during ALSA sequencer operations, leading to downtime for audio, MIDI, or multimedia workloads; low EPSS and no KEV status indicate limited active exploitation risk.

How an attack unfolds

An attacker or misbehaving user-space process invokes ALSA sequencer event expansion paths that perform indirect calls through the mismatched function pointers; with kCFI active the kernel detects the prototype violation at runtime and terminates the thread or panics rather than allowing a ROP chain.

How to fix it

Update the Linux kernel to a version containing commit b38486e82ecb9f3046e0184205f6b61408fc40c9 or later stable releases that remove the casts and align prototypes with snd_seq_dump_func_t; rebuild with the same compiler flags to verify the warning is eliminated.

How to confirm the fix worked

Confirm the presence of the fix commit in the kernel source tree, verify that seq_copy_in_user and seq_copy_in_kernel now match snd_seq_dump_func_t exactly, and ensure the kernel builds cleanly under -Wcast-function-type-strict with no runtime CFI violations during ALSA sequencer stress tests.

Typical attack path

1. Compile or run kernel with CONFIG_CFI_CLANG and -Wcast-function-type-strict enabled
2. Trigger snd_seq_expand_var_event via sequencer file descriptor or MIDI event
3. Cause invocation of seq_copy_in_user or seq_copy_in_kernel through casted function pointer
4. Observe CFI failure manifesting as panic or killed thread

How to detect it

Search kernel logs and crash dumps for messages indicating CFI prototype mismatch or ALSA sequencer function pointer violations; correlate with processes that open /dev/snd/seq or perform MIDI event expansion.

What your security team should do

• Apply the referenced upstream kernel commit or distribution backport immediately on systems using CONFIG_CFI_CLANG
• Audit custom kernel builds for any similar function-pointer casts in ALSA or other subsystems
• Monitor kernel logs for CFI-related panics after deployment until all nodes are updated