CVE-2022-50016
published 2025-06-18CVE-2022-50016: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.18%
8.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.
The issue was reported with IPC4 firmware but the same condition is present
for IPC3.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.19.6-1 (bookworm) | linux 5.19.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 273020522ef62361c5d86eebe45a72418ed8dea4 < 230f646085d17a008b609eb8fe8befb8811868f0 | 230f646085d17a008b609eb8fe8befb8811868f0 |
| linux | linux | >= 273020522ef62361c5d86eebe45a72418ed8dea4 < acacd9eefd0def5a83244d88e5483b5f38ee7287 | acacd9eefd0def5a83244d88e5483b5f38ee7287 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 5.2 < 5.19.4 | 5.19.4 |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50016 [MEDIUM] CWE-476 kernel: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
kernel: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.
The issue was reported with IPC4 firmware but the same condition is present
for IPC3.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affecte
Microsoft
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
vendor_msrc·2025-06-10·CVSS 5.5
CVE-2022-50016 [MEDIUM] CWE-476 ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2022-50016: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ...
vendor_debian·2022·CVSS 5.5
CVE-2022-50016 [MEDIUM] CVE-2022-50016: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ...
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3.
Scope: local
bookworm: resolved (fixed in 5.19.6-1)
bullseye: open
forky: resolved (fixed in 5.19.6-1)
sid: resolved (fixed in 5.19.6-1)
trixie: resolved (fixed in 5.19.6-1)
GHSA
GHSA-wc54-j9wv-p9v7: In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
It is not y
ghsa_unreviewed·2025-06-18
CVE-2022-50016 [MEDIUM] CWE-476 GHSA-wc54-j9wv-p9v7: In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
It is not y
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.
The issue was reported with IPC4 firmware but the same condition is present
for IPC3.
OSV
CVE-2022-50016: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet
osv·2025-06-18·CVSS 5.5
CVE-2022-50016 [MEDIUM] CVE-2022-50016: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3.
No detection rules found.
No public exploits indexed.
2025-06-18
Published