tty: fix possible null-ptr-defer in spk_ttyio_release

Description

In the Linux kernel, the following vulnerability has been resolved: tty: fix possible null-ptr-defer in spk_ttyio_release Run the following tests on the qemu platform: syzkaller:~# modprobe speakup_audptr input: Speakup as /devices/virtual/input/input4 initialized device: /dev/synth, node (MAJOR 10, MINOR 125) speakup 3.1.6: initialized synth name on entry is: (null) synth probe spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned failed (errno -16), then remove the module, we will get a null-ptr-defer problem, as follow: syzkaller:~# modprobe -r speakup_audptr releasing synth audptr BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1 RIP: 0010:mutex_lock+0x14/0x30 Call Trace: <TASK> spk_ttyio_release+0x19/0x70 [speakup] synth_release.part.6+0xac/0xc0 [speakup] synth_remove+0x56/0x60 [speakup] __x64_sys_delete_module+0x156/0x250 ? fpregs_assert_state_consistent+0x1d/0x50 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Modules linked in: speakup_audptr(-) speakup Dumping ftrace buffer: in_synth->dev was not initialized during modprobe, so we add check for in_synth->dev to fix this bug.

Scores

EPSS (exploitation in 30 days)

0.25% · top 84% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

• CWE-476 (opens in a new tab)All about CWE-476 and its CVEs

Affected products

• Linux · Linux

  • affected 4f2a81f3a88217e7340b2cab5c0a5ebd0112514c – < 2da67bff29ab49caafb0766e8b8383b735ff796f
  • affected 4f2a81f3a88217e7340b2cab5c0a5ebd0112514c – < 64152e05a4de3ebf59f1740a0985a6d5fba0c77b
  • affected 4f2a81f3a88217e7340b2cab5c0a5ebd0112514c – < 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5

• Linux · Linux

  • affected 5.12
  • unaffected < 5.12
  • unaffected 5.15.90 – ≤ 5.15.*
  • unaffected 6.1.8 – ≤ 6.1.*
  • unaffected 6.2 – ≤ *

References (3)

• https://git.kernel.org/stable/c/2da67bff29ab49caafb0766e8b8383b735ff796f (opens in a new tab)
• https://git.kernel.org/stable/c/64152e05a4de3ebf59f1740a0985a6d5fba0c77b (opens in a new tab)
• https://git.kernel.org/stable/c/5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-48870](https://trackcve.app/badge/CVE-2022-48870.svg)](https://trackcve.app/cve/CVE-2022-48870)

Record last updated 11 May 2026, 18:48 UTC.