CVE-2022-48927
iio: adc: tsc2046: fix memory corruption by preventing array overflow
Reported by linux · Published August 22, 2024
In the Linux kernel, the following vulnerability has been resolved: iio: adc: tsc2046: fix memory corruption by preventing array overflow On one side we have indio_dev->num_channels includes all physical channels + timestamp channel. On other side we have an array allocated only for physical channels. So, fix memory corruption by ARRAY_SIZE() instead of num_channels variable. Note the first case is a cleanup rather than a fix as the software timestamp channel bit in active_scanmask is never set by the IIO core.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| linux_kernel | linux | 5.16.12, 5.15.26 |
| Linux | Linux | 082d2c047b0d305bb0b6e9f9d671a09470e2db2d |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 9374e8f5a38defe90bc65b2decf317c1c62d91dd, 9374e8f5a38defe90bc65b2decf317c1c62d91dd, 9374e8f5a38defe90bc65b2decf317c1c62d91dd |
| Linux | Linux | 5.14, 0, 5.15.26 |
| Linux | Linux | 5.17, 0, 5.15.26 |
| linux | linux_kernel | 5.14, 5.14, 5.14 |
Timeline
- Aug 21, 2024 CVE Published
- Aug 22, 2024 EPSS Score (30 in total, the first dated here)
- May 23, 2026 Coalition ESS Score
- Jun 2, 2026 Security Advisory (36 in total, the first dated here)
- Aug 5, 2026 CVE Updated
- Aug 10, 2026 Distribution Patch (20 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-48927
vulnetix vdb fixes CVE-2022-48927Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-48927/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart