Security readout for executives and security teams
Plain-English summary
CVE-2022-48947 is a Linux kernel Bluetooth issue in L2CAP configuration handling. Repeated L2CAP configuration requests can make an internal 8-bit counter wrap past 255. The public record does not state a proven business impact, CVSS score, or active exploitation, so urgency depends on Bluetooth exposure and vendor kernel status.
Executive priority
Treat as exposure-driven. It is a kernel Bluetooth flaw with an upstream fix, but public severity and exploitation evidence are incomplete. Prioritize patch validation on Bluetooth-capable Linux assets and defer emergency handling unless vendor advisories indicate higher impact.
Technical view
The issue is in Linux kernel Bluetooth L2CAP. Repeated L2CAP_CONF_REQ packets can increment chan->num_conf_rsp until the u8 value wraps. The upstream fix adds a boundary check using L2CAP_MAX_CONF_RSP. Affected Linux kernel entries are listed, with multiple stable commit references available.
Likely exposure
Exposure is most relevant to Linux systems with Bluetooth enabled or otherwise reachable at the L2CAP layer. Servers without Bluetooth hardware or disabled Bluetooth are less likely to be exposed, but the source bundle does not define exact prerequisites, attack range, or impact.
Exploitation context
The bundle marks this CVE as not in KEV and provides no cited evidence of active exploitation. It includes a btmon log showing malformed or repeated Bluetooth traffic, but does not provide exploit status, exploit maturity, or confirmed real-world abuse.
Researcher notes
The useful anchor is the counter wrap in chan->num_conf_rsp and the L2CAP_MAX_CONF_RSP boundary check. The source bundle does not state consequence, privilege requirements, range, or reliability. Avoid assuming denial of service, code execution, or local versus adjacent attack requirements without vendor evidence.
Mitigation direction
- Update affected Linux kernels to builds containing the referenced stable fixes.
- Check distribution vendor advisories for the correct fixed package version.
- Prioritize systems where Bluetooth is enabled, paired, or operationally required.
- Where Bluetooth is unnecessary, follow vendor guidance to reduce Bluetooth exposure.
Validation and detection
- Inventory Linux kernel versions across endpoints, appliances, and embedded systems.
- Identify systems with Bluetooth hardware, drivers, or services enabled.
- Confirm kernel changelogs include one of the referenced stable fix commits.
- Track vendor package status rather than relying only on upstream version numbers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-48947 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/49d5867819ab7c744852b45509e8469839c07e0eCVE reference, Linux
- https://git.kernel.org/stable/c/95f1847a361c7b4bf7d74c06ecb6968455082c1aCVE reference, Linux
- https://git.kernel.org/stable/c/ad528fde0702903208d0a79d88d5a42ae3fc235bCVE reference, Linux
- https://git.kernel.org/stable/c/9fdc79b571434af7bc742da40a3405f038b637a7CVE reference, Linux
- https://git.kernel.org/stable/c/f3fe6817156a2ad4b06f01afab04638a34d7c9a6CVE reference, Linux
- https://git.kernel.org/stable/c/19a78143961a197de8502f4f29c453b913dc3c29CVE reference, Linux
- https://git.kernel.org/stable/c/5550bbf709c323194881737fd290c4bada9e6eadCVE reference, Linux
- https://git.kernel.org/stable/c/bcd70260ef56e0aee8a4fc6cd214a419900b0765CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.