CVE-2022-49250: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49250 affects the Linux kernel's ASoC (ALSA System on Chip) codecs, specifically the rx-macro component. The vulnerability was discovered in the handling of compander access for AUX interpolator in the sound subsystem. The issue was fixed in Linux kernel version 5.18-rc1 through commit 42c709c4e1ce4c136891530646c9abd5dff3524f (Kernel Git).

The vulnerability exists in the rxmacroloadcompandercoeff function within the lpass-rx-macro.c file. The issue occurs because the AUX interpolator does not have a compander, but the code was attempting to access compander data without proper validation. This could lead to an out-of-bounds array access in the comp_enabled[] array (Debian Tracker).

When exploited, this vulnerability could result in an array out-of-bounds access, potentially leading to memory corruption or system instability in affected Linux systems using the ASoC codec driver (Kernel Git).

The issue has been fixed in Linux kernel version 5.18-rc1 and backported to various stable kernel versions. The fix involves adding a check to verify if the component is an AUX interpolator before attempting to access compander data. Users should update their Linux kernel to a patched version. For Debian systems, fixed versions are available in bullseye (5.10.234-1), bookworm (6.1.128-1), and sid/trixie (6.12.17-1) (Debian Tracker).