LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49910: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu Fix the race condition between the following two flows that run in parallel: 1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) -> __sock_queue_rcv_skb. 2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram. An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2cap_reassemble_sdu can't use the SKB after that function returns. However, some places continue accessing struct l2cap_ctrl that resides in the SKB's CB for a short time after l2cap_reassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8). Fix it by keeping a local copy of struct l2cap_ctrl. BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169 Workqueue: hci0 hci_rx_work [bluetooth] Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth ret_from_fork (arch/x86/entry/entry_64.S:306) </TASK> Allocated by task 43169: kasan_save_stack (mm/kasan/common.c:39) __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293) __alloc_skb (net/core/skbuff.c:414) l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth process_one_work (kernel/workqueue.c:2289) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437) kthread (kernel/kthread.c:376) ret_from_fork (arch/x86/entry/entry_64.S:306) Freed by task 27920: kasan_save_stack (mm/kasan/common.c:39) kasan_set_track (mm/kasan/common.c:45) kasan_set_free_info (mm/kasan/generic.c:372) ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328) slab_free_freelist_hook (mm/slub.c:1780) kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553) skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323) bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth sock_read_iter (net/socket.c:1087) new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401) vfs_read (fs/read_write.c:482) ksys_read (fs/read_write.c:620) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49910 is a Linux kernel Bluetooth bug. A race in L2CAP packet handling can leave the kernel reading memory after it has been freed. The source bundle confirms a kernel fix, but provides no CVSS score, no CWE, and no evidence of active exploitation.

Executive priority

Treat as a targeted kernel maintenance issue, not an emergency based on current evidence. Prioritize patching Bluetooth-capable Linux fleets and embedded devices because kernel memory safety bugs can have high impact if later weaponized.

Technical view

The flaw is a use-after-free in Linux Bluetooth L2CAP reassembly. l2cap_reassemble_sdu can queue an SKB while another path dequeues and frees it through bt_sock_recvmsg and skb_free_datagram. Later access to l2cap_ctrl in the SKB control block triggers the condition. The fix keeps a local copy of l2cap_ctrl.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel lines with Bluetooth enabled or present. Laptops, desktops, IoT, and embedded Linux devices are more likely candidates than servers without Bluetooth. Exact exposure depends on distribution backports and whether the referenced stable fixes are included.

Exploitation context

The bundle documents a KASAN crash trace and race condition, not an exploit. KEV is false, and the provided sources do not state active exploitation. Bluetooth context suggests local wireless interaction may matter, but the bundle does not define a complete attack vector.

Researcher notes

The affected data lists Linux kernel versions and stable commit references, but lacks CVSS, CWE, and exploitability detail. Validation should focus on kernel lineage, distribution backports, and Bluetooth reachability rather than assuming all Linux systems are exposed.

Mitigation direction

  • Update Linux kernel packages using vendor or distribution guidance.
  • Prioritize devices with Bluetooth enabled, exposed, or business-critical.
  • Disable Bluetooth where it is not operationally required pending patching.
  • Confirm the installed kernel includes the referenced stable fix commits.
  • Track distribution advisories for backported fixes and support status.

Validation and detection

  • Inventory Linux kernel versions across endpoints, IoT, and embedded systems.
  • Identify systems with Bluetooth adapters, services, or modules enabled.
  • Compare installed kernels against vendor-fixed builds or referenced stable commits.
  • Check CVE-2022-49910 status in distribution security trackers.
  • Document exceptions where Bluetooth is absent or permanently disabled.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49910 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4b51dae96731c9d82f5634e75ac7ffd3b9c1b060, 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060, 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060, 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060, 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060, 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060, 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060, 4b51dae96731c9d82f5634e75ac7ffd3b9c1b060unaffected
LinuxLinux3.6, 0, 4.9.333, 4.14.299, 4.19.265, 5.4.224, 5.10.154, 5.15.78, 6.0.8, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.