CVE-2022-49249: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49249 affects the Linux kernel's ASoC (ALSA System on Chip) codec driver for the WCD938x audio codec. The vulnerability was discovered in the wcd938x.c file where accessing enums using integer values could result in array out-of-bounds access on platforms like aarch64 where sizeof(long) is 8 bytes compared to enum size which is 4 bytes (Kernel Commit).

The vulnerability exists in the sound/soc/codecs/wcd938x.c file where the tx_mode and hph_mode values were incorrectly accessed using integer values instead of enumerated items. This could lead to accessing array elements beyond their bounds on 64-bit architectures where long integers are 8 bytes but enums are 4 bytes. The issue was fixed by changing ucontrol->value.integer.value[0] to ucontrol->value.enumerated.item[0] (Kernel Commit).

The vulnerability could lead to out-of-bounds memory access when using the WCD938x audio codec driver on 64-bit architectures like aarch64, potentially causing system instability or crashes (Kernel Commit).

The vulnerability requires local access to a system using the affected WCD938x audio codec driver. It can be triggered through normal audio control operations on affected platforms (Kernel Commit).

The issue was fixed in the Linux kernel by modifying the code to use enumerated items instead of integer values. The fix was implemented through commit cc587b7c8fbbe128f6bd0dad025a0caea5e6d164 and backported to stable kernel versions (Kernel Commit).