CVE-2022-49478

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been identified, specifically in the pvrusb2 media module. The issue arises from an array-index-out-of-bounds error in the pvr2 i2c core init function. This occurs because the hdw->unit number is initialized with -1, and if the initialization table walk fails, this value remains unchanged. As a result, the code uses this member for array indexing without proper validation, leading to the error. The problem was reported by Syzbot.

Recommendations To resolve this issue, apply the fix that adds a sanity check to prevent the array-index-out-of-bounds error in the pvr2 i2c core init function. Move the hdw->workpoll initialization to prevent warnings in the flush work function.