{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49792","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-05-01T14:05:17.224Z","datePublished":"2025-05-01T14:09:23.655Z","dateUpdated":"2026-08-05T08:56:21.015Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:56:21.015Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: mp2629: fix potential array out of bound access\n\nAdd sentinel at end of maps to avoid potential array out of\nbound access in iio core."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is mp2629_adc_probe() on an on-board I2C PMIC (MFD cell), reached at boot or via local module load/sysfs bind; there is no network or physical-insertion attack surface.\nAC:L - Every probe of the mp2629_adc cell deterministically walks past the unterminated mp2629_adc_maps[] in iio_map_array_register(); there is no race or attacker-uncontrollable precondition.\nPR:L - The OOB read and poisoning of the global iio_map_list occur during normal boot-time probe with no capability check, so an unprivileged local user on an MP2629-equipped device is exposed to the corrupted state.\nUI:N - The bug fires automatically when the MFD core instantiates the mp2629_adc cell; no victim action such as a mount or file open is required.\nS:U - The OOB read, corrupted iio_map_list, and any later wild-pointer dereference stay within the kernel's security authority with no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is an unbounded OOB read through kernel .data until a NULL is found, and OOB-derived pointers are later strcmp()'d in iio_channel_get_sys()/iio_channel_get_all(), reading arbitrary kernel memory.\nI:L - Bogus entries built from OOB memory are injected into iio_map_list and can propagate garbage consumer_data to consumers, corrupting kernel state, but the array is only read so there is no OOB write or control-flow hijack primitive.\nA:H - Garbage map entries carry non-string values that strcmp() later dereferences during charger/IIO consumer lookup, causing a kernel oops or panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/adc/mp2629_adc.c"],"versions":[{"version":"7abd9fb6468225f5c7f83149ce279cc1a912a68a","lessThan":"d95b85c5084ad70011988861ee864529eefa1da0","status":"affected","versionType":"git"},{"version":"7abd9fb6468225f5c7f83149ce279cc1a912a68a","lessThan":"1678d4abb2dc2ca3b05b998a9d88616976e4f947","status":"affected","versionType":"git"},{"version":"7abd9fb6468225f5c7f83149ce279cc1a912a68a","lessThan":"399b2105a2240e730b9f3880bd8f154247539aa7","status":"affected","versionType":"git"},{"version":"7abd9fb6468225f5c7f83149ce279cc1a912a68a","lessThan":"ca1547ab15f48dc81624183ae17a2fd1bad06dfc","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/iio/adc/mp2629_adc.c"],"versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","status":"unaffected","versionType":"semver"},{"version":"5.10.156","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.80","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.0.10","lessThanOrEqual":"6.0.*","status":"unaffected","versionType":"semver"},{"version":"6.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.10.156"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.15.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d95b85c5084ad70011988861ee864529eefa1da0"},{"url":"https://git.kernel.org/stable/c/1678d4abb2dc2ca3b05b998a9d88616976e4f947"},{"url":"https://git.kernel.org/stable/c/399b2105a2240e730b9f3880bd8f154247539aa7"},{"url":"https://git.kernel.org/stable/c/ca1547ab15f48dc81624183ae17a2fd1bad06dfc"}],"title":"iio: adc: mp2629: fix potential array out of bound access","x_generator":{"engine":"bippy-1.2.0"}}}}