Security readout for executives and security teams
Plain-English summary
CVE-2022-50386 is a Linux kernel Bluetooth L2CAP use-after-free flaw. A successful attack could compromise confidentiality, integrity, and availability. The source rates it high severity with CVSS 8.0. Exposure depends on affected kernel versions and whether Bluetooth/L2CAP is reachable in the environment.
Executive priority
Treat as a high-priority kernel maintenance issue, especially for Bluetooth-capable endpoints and embedded systems. It is not presented as actively exploited in the supplied sources, but the impact rating justifies prompt inventory, patch planning, and temporary Bluetooth reduction where operationally acceptable.
Technical view
The resolved kernel issue adds l2cap_chan_hold_unless_zero() after __l2cap_get_chan_blah() to prevent a use-after-free seen by KASAN in mutex locking during L2CAP channel handling. It is classified as CWE-416 and tied to Linux stable commits across multiple kernel branches.
Likely exposure
Most relevant exposure is Linux systems running affected kernel branches with Bluetooth functionality enabled or reachable. The CVSS vector is adjacent-network, low-privilege, no user interaction, so practical exposure is narrower than internet-facing services but important for endpoints, embedded devices, and servers with Bluetooth enabled.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. They support a high-impact memory-safety issue in Bluetooth L2CAP with adjacent access and low privileges, but they do not provide public exploit evidence or attack prevalence.
Researcher notes
Evidence is limited to the CVE record and Linux stable commit references. The affected-version data is broad and branch-specific, so map exposure through downstream distro advisories rather than raw upstream version strings alone. Do not infer exploitability beyond the CVSS vector and kernel fix description.
Mitigation direction
- Inventory Linux kernel versions and Bluetooth-enabled assets.
- Apply vendor kernel updates containing the referenced stable fixes.
- If Bluetooth is unnecessary, disable it pending patch validation.
- Prioritize mobile, workstation, IoT, and embedded Linux fleets.
- Track distro advisories for backported fixes and package names.
Validation and detection
- Confirm running kernel versions against vendor advisories.
- Check whether Bluetooth services or adapters are enabled.
- Verify patched builds include the relevant stable commit for their branch.
- Run regression tests for Bluetooth-dependent business workflows.
- Document exceptions where Bluetooth cannot be disabled or patched promptly.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 11e40d6c0823
- Linux stable commit 843fc4e386dd
- Linux stable commit d91fc2836562
- Linux stable commit 7d6f9cb24d2b
- Linux stable commit 0c108cf3ad38
- Linux stable commit d1e894f950ad
- Linux stable commit 6ffde6e03085
- Linux stable commit 15fc21695eb6
- Linux stable commit 35fcbc4243aa
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50386 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.15.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8HighVector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/11e40d6c0823f699d8ad501e48d1c3ae4be386cdCVE reference
- https://git.kernel.org/stable/c/843fc4e386dd84b806a7f07fb062d8c3a44e5364CVE reference
- https://git.kernel.org/stable/c/d91fc2836562f299f34e361e089e9fe154da4f73CVE reference
- https://git.kernel.org/stable/c/7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45CVE reference
- https://git.kernel.org/stable/c/0c108cf3ad386e0084277093b55a351c49e0be27CVE reference
- https://git.kernel.org/stable/c/d1e894f950ad48897d1a7cb05909ea29d8c3810eCVE reference
- https://git.kernel.org/stable/c/6ffde6e03085874ae22263ff4cef4869f797e84fCVE reference
- https://git.kernel.org/stable/c/15fc21695eb606bdc5d483b92118ee42610a952dCVE reference
- https://git.kernel.org/stable/c/35fcbc4243aad7e7d020b7c1dfb14bb888b20a4fCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.