media: v4l2-dv-timings.c: fix too strict blanking sanity checks
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-dv-timings.c: fix too strict blanking sanity checks Sanity checks were added to verify the v4l2_bt_timings blanking fields in order to avoid integer overflows when userspace passes weird values. But that assumed that userspace would correctly fill in the front porch, backporch and sync values, but sometimes all you know is the total blanking, which is then assigned to just one of these fields. And that can fail with these checks. So instead set a maximum for the total horizontal and vertical blanking and check that each field remains below that. That is still sufficient to avoid integer overflows, but it also allows for more flexibility in how userspace fills in these fields.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 4.9.332 to before 4.9.336; 4.14.298 to before 4.14.302; 4.19.264 to before 4.19.269; 5.4.223 to before 5.4.227; 5.10.153 to before 5.10.159; 5.15.77 to before 5.15.83; 6.0.7 to before 6.0.13 | 4.9.336, 4.14.302, 4.19.269, 5.4.227, 5.10.159, 5.15.83, 6.0.13 | Patch available | CNA |
- Linux VendorLinux Affected 4.9.332 to before 4.9.336; 4.14.298 to before 4.14.302; 4.19.264 to before 4.19.269; 5.4.223 to before 5.4.227; 5.10.153 to before 5.10.159; 5.15.77 to before 5.15.83; 6.0.7 to before 6.0.13 Fixed in 4.9.336, 4.14.302, 4.19.269, 5.4.227, 5.10.159, 5.15.83, 6.0.13 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.9.332 to before 4.9.336; 4.14.298 to before 4.14.302; 4.19.264 to before 4.19.269; 5.4.226 to before 5.4.227; 5.10.153 to before 5.10.159; 5.15.77 to before 5.15.83; 6.0.7 to before 6.0.13 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.9.332 to before 4.9.336; 4.14.298 to before 4.14.302; 4.19.264 to before 4.19.269; 5.4.226 to before 5.4.227; 5.10.153 to before 5.10.159; 5.15.77 to before 5.15.83; 6.0.7 to before 6.0.13 Vulnerable ·Linux
Remediation
- Fix · CNA Linux (Linux) Fixed in 4.9.336, 4.14.302, 4.19.269, 5.4.227, 5.10.159, 5.15.83, 6.0.13
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2022-48987
- 2026-10-03 Alias added: GHSA-w6fg-43jh-g466
References
Patch 8
- https://git.kernel.org/stable/c/0d73b49c4037199472b29574ae21c21aef493971
- https://git.kernel.org/stable/c/a2b56627c0d13009e02f6f2c0206c0451ed19a0e
- https://git.kernel.org/stable/c/2572ab14b73aa45b6ae7e4c089ccf119fed5cf89
- https://git.kernel.org/stable/c/4afc77068e36cee45b39d4fdc7513de26980f72c
- https://git.kernel.org/stable/c/32f01f0306a98629508f84d7ef0d1d037bc274a2
- https://git.kernel.org/stable/c/6fb8bc29bfa80707994a63cc97e2f9920e0b0608
- https://git.kernel.org/stable/c/d3d14cdf1c7ae2caa3e999bae95ba99e955fb7c3
- https://git.kernel.org/stable/c/5eef2141776da02772c44ec406d6871a790761ee
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2022-48987 · CVE Program
- CVE-2022-48987 · NVD
- FIRST EPSS
- GHSA-w6fg-43jh-g466 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-48987 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences