CVE-2022-50773: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50773 is a null-pointer dereference vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) MTS64 driver (snd_mts64). The flaw exists in the snd_mts64_interrupt function, which can be triggered when the MTS64 module is loaded multiple times before successful initialization, causing a kernel panic. It affects the Linux kernel and was publicly disclosed on December 24, 2025. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a null-pointer dereference (CWE-476) in the snd_mts64_interrupt interrupt handler, which is invoked via the parport IRQ handler before the MTS64 structure is fully initialized. When the snd-mts64 kernel module fails to probe (e.g., returning error -5 for no such device) and is subsequently reloaded, an interrupt can fire and dereference an uninitialized (NULL) MTS pointer, triggering a kernel oops at address 0x0000000000000000. The attack vector is local, requires low privileges, and no user interaction. The fix adds a NULL check for the MTS structure within the interrupt handler before proceeding (Red Hat Bugzilla).

Successful exploitation causes a kernel panic (BUG: kernel NULL pointer dereference), resulting in a system crash and forced reboot — a denial of service condition. There is no impact on confidentiality or integrity; the vulnerability is limited to availability. The affected scope is systems running the Linux kernel with the snd-mts64, parport, and parport_pc modules loaded (Red Hat Advisory, Red Hat Bugzilla).

1. Precondition: Obtain local access to a Linux system with CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m, and CONFIG_SND_MTS64=m compiled as loadable modules.
2. Trigger failed probe: Execute modprobe snd-mts64 on a system where the MTS64 hardware is absent or unavailable, causing the probe to fail with error -5.
3. Reload the module: Immediately execute modprobe snd-mts64 again (or script repeated loading), creating a race condition where an interrupt fires during the second probe attempt.
4. Trigger interrupt: The parport IRQ fires and calls snd_mts64_interrupt, which dereferences the uninitialized (NULL) MTS pointer.
5. Kernel panic: The null dereference causes a kernel oops and panic, crashing the system (Red Hat Bugzilla).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries showing BUG: kernel NULL pointer dereference, address: 0000000000000000 with a call trace including snd_mts64_interrupt, parport_irq_handler, and snd_mts64_probe.
• Logs: Messages such as snd_mts64: probe of snd_mts64.0 failed with error -5 followed by Kernel panic - not syncing: Fatal exception in interrupt.
• Process: Repeated modprobe snd-mts64 invocations visible in process or audit logs shortly before a system crash.

The upstream Linux kernel patch adds a NULL check for the MTS structure in snd_mts64_interrupt to prevent the dereference. Users should update to a patched kernel version that includes the fix (referenced in upstream stable commits). As a workaround, avoid loading the snd-mts64 module on systems without MTS64 hardware, restrict kernel module loading via modprobe blacklisting (blacklist snd-mts64 in /etc/modprobe.d/), or use kernel module loading restrictions (e.g., module signing enforcement). SUSE has issued kernel advisories addressing this CVE (Red Hat Bugzilla).