{"cve":"CVE-2022-48696","nvd":{"published":"2024-05-03T16:15:08.290","modified":"2026-08-04T10:17:16.267","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: spi: Reserve space for register address/padding\n\nCurrently the max_raw_read and max_raw_write limits in regmap_spi struct\ndo not take into account the additional size of the transmitted register\naddress and padding.  This may result in exceeding the maximum permitted\nSPI message size, which could cause undefined behaviour, e.g. data\ncorruption.\n\nFix regmap_get_spi_bus() to properly adjust the above mentioned limits\nby reserving space for the register address/padding as set in the regmap\nconfiguration.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":7.1},"cwes":["CWE-120"],"references":["https://git.kernel.org/stable/c/15ff1f17847c19174b260bd7dd0de33edcebd45e","https://git.kernel.org/stable/c/f5723cfc01932c7a8d5c78dbf7e067e537c91439","https://git.kernel.org/stable/c/15ff1f17847c19174b260bd7dd0de33edcebd45e","https://git.kernel.org/stable/c/f5723cfc01932c7a8d5c78dbf7e067e537c91439"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:49:23.840078609+00:00"},"epss":{"cve":"CVE-2022-48696","score":0.00197,"percentile":0.09472,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}