In the Linux kernel, the following vulnerability has been resolved: soundwire: revisit driver bind/unbind and callbacks In the SoundWire probe, we store a pointer from the driver ops into the 'slave' structure. This can lead to kernel oopses when unbinding codec drivers, e.g. with the following sequence to remove machine driver and codec driver. /sbin/modprobe -r snd_soc_sof_sdw /sbin/modprobe -r snd_soc_rt711 The full details can be found in the BugLink below, for reference the two following examples show different cases of driver ops/callbacks being invoked after the driver .remove(). kernel: BUG: kernel NULL pointer dereference, address: 0000000000000150 kernel: Workqueue: events cdns_update_slave_status_work [soundwire_cadence] kernel: RIP: 0010:mutex_lock+0x19/0x30 kernel: Call Trace: kernel: ? sdw_handle_slave_status+0x426/0xe00 [soundwire_bus 94ff184bf398570c3f8ff7efe9e32529f532e4ae] kernel: ? newidle_balance+0x26a/0x400 kernel: ? cdns_update_slave_status_work+0x1e9/0x200 [soundwire_cadence 1bcf98eebe5ba9833cd433323769ac923c9c6f82] kernel: BUG: unable to handle page fault for address: ffffffffc07654c8 kernel: Workqueue: pm pm_runtime_work kernel: RIP: 0010:sdw_bus_prep_clk_stop+0x6f/0x160 [soundwire_bus] kernel: Call Trace: kernel: <TASK> kernel: sdw_cdns_clock_stop+0xb5/0x1b0 [soundwire_cadence 1bcf98eebe5ba9833cd433323769ac923c9c6f82] kernel: intel_suspend_runtime+0x5f/0x120 [soundwire_intel aca858f7c87048d3152a4a41bb68abb9b663a1dd] kernel: ? dpm_sysfs_remove+0x60/0x60 This was not detected earlier in Intel tests since the tests first remove the parent PCI device and shut down the bus. The sequence above is a corner case which keeps the bus operational but without a driver bound. While trying to solve this kernel oopses, it became clear that the existing SoundWire bus does not deal well with the unbind case. Commit 528be501b7d4a ("soundwire: sdw_slave: add probe_complete structure and new fields") added a 'probed' status variable and a 'probe_complete' struct completion. This status is however not reset on remove and likewise the 'probe complete' is not re-initialized, so the bind/unbind/bind test cases would fail. The timeout used before the 'update_status' callback was also a bad idea in hindsight, there should really be no timing assumption as to if and when a driver is bound to a device. An initial draft was based on device_lock() and device_unlock() was tested. This proved too complicated, with deadlocks created during the suspend-resume sequences, which also use the same device_lock/unlock() as the bind/unbind sequences. On a CometLake device, a bad DSDT/BIOS caused spurious resumes and the use of device_lock() caused hangs during suspend. After multiple weeks or testing and painful reverse-engineering of deadlocks on different devices, we looked for alternatives that did not interfere with the device core. A bus notifier was used successfully to keep track of DRIVER_BOUND and DRIVER_UNBIND events. This solved the bind-unbind-bind case in tests, but it can still be defeated with a theoretical corner case where the memory is freed by a .remove while the callback is in use. The notifier only helps make sure the driver callbacks are valid, but not that the memory allocated in probe remains valid while the callbacks are invoked. This patch suggests the introduction of a new 'sdw_dev_lock' mutex protecting probe/remove and all driver callbacks. Since this mutex is 'local' to SoundWire only, it does not interfere with existing locks and does not create deadlocks. In addition, this patch removes the 'probe_complete' completion, instead we directly invoke the 'update_status' from the probe routine. That removes any sort of timing dependency and a much better support for the device/driver model, the driver could be bound before the bus started, or eons after the bus started and the hardware would be properly initialized in all cases. BugLink: https://github.com/thesofproject/linux/is ---truncated---

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - soundwire: revisit driver bind/unbind and callbacks In the SoundWire probe, we store a pointer from the     driver ops into the 'slave' structure. This can lead to kernel oopses when unbinding codec drivers, e.g.
    with the following sequence to remove machine driver and codec driver. /sbin/modprobe -r snd_soc_sof_sdw     /sbin/modprobe -r snd_soc_rt711 The full details can be found in the BugLink below, for reference the two     following examples show different cases of driver ops/callbacks being invoked after the driver .remove().
    kernel: BUG: kernel NULL pointer dereference, address: 0000000000000150 kernel: Workqueue: events     cdns_update_slave_status_work [soundwire_cadence] kernel: RIP: 0010:mutex_lock+0x19/0x30 kernel: Call     Trace: kernel: ? sdw_handle_slave_status+0x426/0xe00 [soundwire_bus     94ff184bf398570c3f8ff7efe9e32529f532e4ae] kernel: ? newidle_balance+0x26a/0x400 kernel: ?     cdns_update_slave_status_work+0x1e9/0x200 [soundwire_cadence 1bcf98eebe5ba9833cd433323769ac923c9c6f82]     kernel: BUG: unable to handle page fault for address: ffffffffc07654c8 kernel: Workqueue: pm     pm_runtime_work kernel: RIP: 0010:sdw_bus_prep_clk_stop+0x6f/0x160 [soundwire_bus] kernel: Call Trace:
    kernel: <TASK> kernel: sdw_cdns_clock_stop+0xb5/0x1b0 [soundwire_cadence     1bcf98eebe5ba9833cd433323769ac923c9c6f82] kernel: intel_suspend_runtime+0x5f/0x120 [soundwire_intel     aca858f7c87048d3152a4a41bb68abb9b663a1dd] kernel: ? dpm_sysfs_remove+0x60/0x60 This was not detected     earlier in Intel tests since the tests first remove the parent PCI device and shut down the bus. The     sequence above is a corner case which keeps the bus operational but without a driver bound. While trying     to solve this kernel oopses, it became clear that the existing SoundWire bus does not deal well with the     unbind case. Commit 528be501b7d4a (soundwire: sdw_slave: add probe_complete structure and new fields)     added a 'probed' status variable and a 'probe_complete' struct completion. This status is however not     reset on remove and likewise the 'probe complete' is not re-initialized, so the bind/unbind/bind test     cases would fail. The timeout used before the 'update_status' callback was also a bad idea in hindsight,     there should really be no timing assumption as to if and when a driver is bound to a device. An initial     draft was based on device_lock() and device_unlock() was tested. This proved too complicated, with     deadlocks created during the suspend-resume sequences, which also use the same device_lock/unlock() as the     bind/unbind sequences. On a CometLake device, a bad DSDT/BIOS caused spurious resumes and the use of     device_lock() caused hangs during suspend. After multiple weeks or testing and painful reverse-engineering     of deadlocks on different devices, we looked for alternatives that did not interfere with the device core.
    A bus notifier was used successfully to keep track of DRIVER_BOUND and DRIVER_UNBIND events. This solved     the bind-unbind-bind case in tests, but it can still be defeated with a theoretical corner case where the     memory is freed by a .remove while the callback is in use. The notifier only helps make sure the driver     callbacks are valid, but not that the memory allocated in probe remains valid while the callbacks are     invoked. This patch suggests the introduction of a new 'sdw_dev_lock' mutex protecting probe/remove and     all driver callbacks. Since this mutex is 'local' to SoundWire only, it does not interfere with existing     locks and does not create deadlocks. In addition, this patch removes the 'probe_complete' completion,     instead we directly invoke the 'update_status' from the probe routine. That removes any sort of timing     dependency and a much better support for the device/driver model, the driver could be bound before the bus     started, or eons after the bus started and the hardware would be properly initialized in all cases.
    BugLink: https://github.com/thesofproject/linux/is ---truncated--- (CVE-2022-50144)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02264-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47557: net/sched: sch_ets: do not peek at classes beyond 'nbands' (bsc#1207361 bsc#1225468).
    - CVE-2021-47595: net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1207361     bsc#1226552).
    - CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821).
    - CVE-2023-52925: netfilter: nf_tables: do not fail inserts if duplicate has expired (bsc#1236822).
    - CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain     (bsc#1222634).
    - CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
    - CVE-2024-27397: kabi: place tstamp needed for nftables set in a hole (bsc#1224095).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
    - CVE-2024-53125: bpf: sync_linked_regs() must preserve subreg_def (bsc#1234156).
    - CVE-2024-53141: netfilter: ipset: add missing range check in bitmap_ip_uadt (bsc#1234381).
    - CVE-2024-53197: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (bsc#1235464).
    - CVE-2024-56770: sch/netem: fix use after free in netem_dequeue (bsc#1235637).
    - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21756: vsock: Orphan socket after transport release (bsc#1238876).
    - CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses     (bsc#1242782).
    - CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37890: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc     (bsc#1243330).
    - CVE-2025-37997: netfilter: ipset: fix region locking in hash types (bsc#1243832).
    - CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1244277).
    - CVE-2025-38001: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (bsc#1244234).
    - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732).
    - CVE-2025-38060: bpf: abort verification if env->cur_state->loop_entry != NULL (bsc#1245155).
    - CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245183).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
245184	Linux Distros Unpatched Vulnerability : CVE-2022-50144	Nessus	Misc.	Local	medium
241963	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2025:02264-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2022-50144

medium

Tenable Plugins

medium

high