{"cve":"CVE-2022-49288","nvd":{"published":"2025-02-26T07:01:05.657","modified":"2026-06-17T05:17:36.510","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix races among concurrent prealloc proc writes\n\nWe have no protection against concurrent PCM buffer preallocation\nchanges via proc files, and it may potentially lead to UAF or some\nweird problem.  This patch applies the PCM open_mutex to the proc\nwrite operation for avoiding the racy proc writes and the PCM stream\nopen (and further operations).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/37b12c16beb6f6c1c3c678c1aacbc46525c250f7","https://git.kernel.org/stable/c/51fce708ab8986a9879ee5da946a2cc120f1036d","https://git.kernel.org/stable/c/5ed8f8e3c4e59d0396b9ccf2e639711e24295bb6","https://git.kernel.org/stable/c/69534c48ba8ce552ce383b3dfdb271ffe51820c3","https://git.kernel.org/stable/c/a21d2f323b5a978dedf9ff1d50f101f85e39b3f2"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2022-49288","score":0.00284,"percentile":0.20977,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}