cbcvebase.
CVE-2022-50386
published 2025-09-18

CVE-2022-50386: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling…

PriorityP342high8CVSS 3.1
AVAACLPRLUINSUCHIHAH
EPSS
0.33%
25.6th percentile
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389

Affected

23 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.3-1 (bookworm)linux 6.0.3-1 (bookworm)
linuxlinux
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 11e40d6c0823f699d8ad501e48d1c3ae4be386cd11e40d6c0823f699d8ad501e48d1c3ae4be386cd
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 843fc4e386dd84b806a7f07fb062d8c3a44e5364843fc4e386dd84b806a7f07fb062d8c3a44e5364
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < d91fc2836562f299f34e361e089e9fe154da4f73d91fc2836562f299f34e361e089e9fe154da4f73
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad457d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 0c108cf3ad386e0084277093b55a351c49e0be270c108cf3ad386e0084277093b55a351c49e0be27
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < d1e894f950ad48897d1a7cb05909ea29d8c3810ed1e894f950ad48897d1a7cb05909ea29d8c3810e
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 6ffde6e03085874ae22263ff4cef4869f797e84f6ffde6e03085874ae22263ff4cef4869f797e84f
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 15fc21695eb606bdc5d483b92118ee42610a952d15fc21695eb606bdc5d483b92118ee42610a952d
linuxlinux>= 3df91ea20e744344100b10ae69a17211fcf5b207 < 35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f
linuxlinux_kernel< 4.9.3314.9.331
linuxlinux_kernel>= 0 < 5.10.158-15.10.158-1
linuxlinux_kernel>= 0 < 6.0.3-16.0.3-1
linuxlinux_kernel>= 0 < 6.0.3-16.0.3-1
linuxlinux_kernel>= 0 < 6.0.3-16.0.3-1
linuxlinux_kernel>= 4.10 < 4.14.2964.14.296
linuxlinux_kernel>= 4.15 < 4.19.2624.19.262
linuxlinux_kernel>= 4.20 < 5.4.2205.4.220
linuxlinux_kernel>= 5.11 < 5.15.755.15.75
linuxlinux_kernel>= 5.16 < 5.19.175.19.17
linuxlinux_kernel>= 5.5 < 5.10.1505.10.150
linuxlinux_kernel>= 6.0 < 6.0.36.0.3

CVSS provenance

nvdv3.18.0HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.0HIGH
vendor_debian8.0HIGH
vendor_redhat8.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.