CVE-2022-49111
published 2025-02-26CVE-2022-49111: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by…
PriorityP343high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.34%
26.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix use after free in hci_send_acl
This fixes the following trace caused by receiving
HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without
first checking if conn->type is in fact AMP_LINK and in case it is
do properly cleanup upper layers with hci_disconn_cfm:
BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50
Read of size 8 at addr ffff88800e404818 by task bluetoothd/142
CPU: 0 PID: 142 Comm: bluetoothd Not tainted
5.17.0-rc5-00006-gda4022eeac1a #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x45/0x59
print_address_description.constprop.0+0x1f/0x150
kasan_report.cold+0x7f/0x11b
hci_send_acl+0xaba/0xc50
l2cap_do_send+0x23f/0x3d0
l2cap_chan_send+0xc06/0x2cc0
l2cap_sock_sendmsg+0x201/0x2b0
sock_sendmsg+0xdc/0x110
sock_write_iter+0x20f/0x370
do_iter_readv_writev+0x343/0x690
do_iter_write+0x132/0x640
vfs_writev+0x198/0x570
do_writev+0x202/0x280
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3
0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05
3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015
RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77
R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580
RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001
R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0
Allocated by task 45:
kasan_save_stack+0x1e/0x40
__kasan_kmalloc+0x81/0xa0
hci_chan_create+0x9a/0x2f0
l2cap_conn_add.part.0+0x1a/0xdc0
l2cap_connect_cfm+0x236/0x1000
le_conn_complete_evt+0x15a7/0x1db0
hci_le_conn_complete_evt+0x226/0x2c0
hci_le_meta_evt+0x247/0x450
hci_event_pack
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < c41de54b0a963e59e4dd04c029a4a6d73f45ef9c | c41de54b0a963e59e4dd04c029a4a6d73f45ef9c |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 643a6c26bd32e339d00ad97b8822b6db009e803c | 643a6c26bd32e339d00ad97b8822b6db009e803c |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 684e505406abaeabe0058e9776f9210bf2747953 | 684e505406abaeabe0058e9776f9210bf2747953 |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 3803d896ddd97c7c16689a5381c0960040727647 | 3803d896ddd97c7c16689a5381c0960040727647 |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 2cc803804ec9a296b3156855d6c8c4ca1c6b84be | 2cc803804ec9a296b3156855d6c8c4ca1c6b84be |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < d404765dffdbd8dcd14758695d0c96c52fb2e624 | d404765dffdbd8dcd14758695d0c96c52fb2e624 |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < 4da302b90b96c309987eb9b37c8547f939f042d2 | 4da302b90b96c309987eb9b37c8547f939f042d2 |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < b3c2ea1fd444b3bb7b82bfd2c3a45418f85c2502 | b3c2ea1fd444b3bb7b82bfd2c3a45418f85c2502 |
| linux | linux | >= 9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 < f63d24baff787e13b723d86fe036f84bdbc35045 | f63d24baff787e13b723d86fe036f84bdbc35045 |
| linux | linux_kernel | < 4.9.311 | 4.9.311 |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 4.10 < 4.14.276 | 4.14.276 |
| linux | linux_kernel | >= 4.15 < 4.19.238 | 4.19.238 |
| linux | linux_kernel | >= 4.20 < 5.4.189 | 5.4.189 |
| linux | linux_kernel | >= 5.11 < 5.15.34 | 5.15.34 |
| linux | linux_kernel | >= 5.16 < 5.16.20 | 5.16.20 |
| linux | linux_kernel | >= 5.17 < 5.17.3 | 5.17.3 |
| linux | linux_kernel | >= 5.5 < 5.10.111 | 5.10.111 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-10-13·CVSS 8.8
CVE-2022-49114 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- SCSI subsystem;
- Bluetooth subsystem;
(CVE-2022-49111, CVE-2022-49114)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtu
Red Hat
kernel: Bluetooth: Fix use after free in hci_send_acl
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2022-49111 [HIGH] kernel: Bluetooth: Fix use after free in hci_send_acl
kernel: Bluetooth: Fix use after free in hci_send_acl
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix use after free in hci_send_acl
This fixes the following trace caused by receiving
HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without
first checking if conn->type is in fact AMP_LINK and in case it is
do properly cleanup upper layers with hci_disconn_cfm:
BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50
Read of size 8 at addr ffff88800e404818 by task bluetoothd/142
CPU: 0 PID: 142 Comm: bluetoothd Not tainted
5.17.0-rc5-00006-gda4022eeac1a #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x45/0x59
print_address_description.constprop.0
Debian
CVE-2022-49111: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ...
vendor_debian·2022·CVSS 7.8
CVE-2022-49111 [HIGH] CVE-2022-49111: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ...
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_cfm: ================================================================== BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142 CPU: 0 PID: 142 Comm: bluetoothd Not tainted 5.17.0-rc5-00006-gda4022eeac1a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x59 print_address_description.
GHSA
GHSA-5wpf-jxv5-j2rg: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix use after free in hci_send_acl
This fixes the following trace cau
ghsa_unreviewed·2025-02-27
CVE-2022-49111 [HIGH] CWE-416 GHSA-5wpf-jxv5-j2rg: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix use after free in hci_send_acl
This fixes the following trace cau
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix use after free in hci_send_acl
This fixes the following trace caused by receiving
HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without
first checking if conn->type is in fact AMP_LINK and in case it is
do properly cleanup upper layers with hci_disconn_cfm:
BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50
Read of size 8 at addr ffff88800e404818 by task bluetoothd/142
CPU: 0 PID: 142 Comm: bluetoothd Not tainted
5.17.0-rc5-00006-gda4022eeac1a #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x45/0x59
print_address_description.constprop.0+0x1f/0x150
kasan_report.cold+0x7f/0x11b
hci_send_a
OSV
CVE-2022-49111: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace cause
osv·2025-02-26·CVSS 7.8
CVE-2022-49111 [HIGH] CVE-2022-49111: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace cause
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_cfm: ================================================================== BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142 CPU: 0 PID: 142 Comm: bluetoothd Not tainted 5.17.0-rc5-00006-gda4022eeac1a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x59 print_address_description.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/2cc803804ec9a296b3156855d6c8c4ca1c6b84behttps://git.kernel.org/stable/c/3803d896ddd97c7c16689a5381c0960040727647https://git.kernel.org/stable/c/4da302b90b96c309987eb9b37c8547f939f042d2https://git.kernel.org/stable/c/643a6c26bd32e339d00ad97b8822b6db009e803chttps://git.kernel.org/stable/c/684e505406abaeabe0058e9776f9210bf2747953https://git.kernel.org/stable/c/b3c2ea1fd444b3bb7b82bfd2c3a45418f85c2502https://git.kernel.org/stable/c/c41de54b0a963e59e4dd04c029a4a6d73f45ef9chttps://git.kernel.org/stable/c/d404765dffdbd8dcd14758695d0c96c52fb2e624https://git.kernel.org/stable/c/f63d24baff787e13b723d86fe036f84bdbc35045
2025-02-26
Published