CVE-2022-49138

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49138", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T01:49:39.268Z", "datePublished": "2025-02-26T01:55:10.632Z", "dateUpdated": "2026-08-05T08:54:02.681Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:54:02.681Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Ignore multiple conn complete events\n\nWhen one of the three connection complete events is received multiple\ntimes for the same handle, the device is registered multiple times which\nleads to memory corruptions. Therefore, consequent events for a single\nconnection are ignored.\n\nThe conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET\nis introduced to identify new connections. To make sure the events do not\ncontain this or another invalid handle HCI_CONN_HANDLE_MAX and checks\nare introduced.\n\nBuglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is in Bluetooth HCI event processing (Connection Complete / Sync / LE Complete) reached via the controller\u2019s HCI path; per kernel guidance Bluetooth is Adjacent, matching phones and other BT-enabled devices in range.\nAC:L - An attacker who can deliver duplicate connection-complete HCI events (malicious/buggy controller or equivalent HCI injection) triggers the double device_add path reliably; no race or other condition outside attacker control is required.\nPR:N - HCI connection-complete handling runs in the kernel during link setup before pairing/authentication and needs no local account or capability on the victim\u2014only an unauthenticated adjacent Bluetooth/HCI source.\nUI:N - If the host is connectable/advertising (common on phones and IoT), connection establishment and subsequent HCI events are processed without requiring the user to mount, open, or otherwise interact with anything.\nS:U - Impact stays in the host kernel\u2019s Bluetooth/driver-core authority; this is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - Duplicate processing calls device_add again; on -EEXIST the error path kfree\u2019s still-registered device_private while it remains on the parent klist, yielding UAF/heap corruption the author also described as use-after-free\u2014sufficient for arbitrary read.\nI:H - The same UAF of device_private while the device stays registered is kernel memory corruption (commit: \u201cmemory corruptions\u201d), enabling heap reuse and control-flow hijacking / arbitrary write, not merely a clean crash.\nA:H - The corrupted sysfs device state leads to a NULL deref in klist_next/device_find_child on disconnect (BUG 215497), i.e. a kernel oops/DoS; UAFs also crash when not fully exploited."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_conn.c", "net/bluetooth/hci_event.c"], "versions": [{"version": "7d0db0a373195385a2e0b19d1f5e4b186fdcffac", "lessThan": "aa1ca580e3ffe62a2c5ea1c095b609b2943c5269", "status": "affected", "versionType": "git"}, {"version": "7d0db0a373195385a2e0b19d1f5e4b186fdcffac", "lessThan": "d5ebaa7c5f6f688959e8d40840b2249ede63b8ed", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_conn.c", "net/bluetooth/hci_event.c"], "versions": [{"version": "2.6.27", "status": "affected"}, {"version": "0", "lessThan": "2.6.27", "status": "unaffected", "versionType": "semver"}, {"version": "5.17.3", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.17.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aa1ca580e3ffe62a2c5ea1c095b609b2943c5269"}, {"url": "https://git.kernel.org/stable/c/d5ebaa7c5f6f688959e8d40840b2249ede63b8ed"}], "title": "Bluetooth: hci_event: Ignore multiple conn complete events", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_conn.c", "net/bluetooth/hci_event.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "aa1ca580e3ffe62a2c5ea1c095b609b2943c5269", "status": "affected", "version": "7d0db0a373195385a2e0b19d1f5e4b186fdcffac", "versionType": "git"}, {"lessThan": "d5ebaa7c5f6f688959e8d40840b2249ede63b8ed", "status": "affected", "version": "7d0db0a373195385a2e0b19d1f5e4b186fdcffac", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/bluetooth/hci_core.h", "net/bluetooth/hci_conn.c", "net/bluetooth/hci_event.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.17.*", "status": "unaffected", "version": "5.17.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "68AC7372-D098-4584-A82A-1F7CD731042F", "versionEndExcluding": "5.17.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Ignore multiple conn complete events\n\nWhen one of the three connection complete events is received multiple\ntimes for the same handle, the device is registered multiple times which\nleads to memory corruptions. Therefore, consequent events for a single\nconnection are ignored.\n\nThe conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET\nis introduced to identify new connections. To make sure the events do not\ncontain this or another invalid handle HCI_CONN_HANDLE_MAX and checks\nare introduced.\n\nBuglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: hci_event: Ignorar varios eventos de conexi\u00f3n completa Cuando uno de los tres eventos de conexi\u00f3n completa se recibe varias veces para el mismo identificador, el dispositivo se registra varias veces, lo que provoca corrupciones de memoria. Por lo tanto, se ignoran los eventos consecuentes para una sola conexi\u00f3n. El estado conn->state puede contener diferentes valores, por lo tanto, se introduce HCI_CONN_HANDLE_UNSET para identificar nuevas conexiones. Para asegurarse de que los eventos no contengan este u otro identificador no v\u00e1lido, se introducen HCI_CONN_HANDLE_MAX y se realizan comprobaciones. Enlace de error: https://bugzilla.kernel.org/show_bug.cgi?id=215497"}], "id": "CVE-2022-49138", "lastModified": "2026-08-04T10:17:36.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-26T07:00:51.047", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aa1ca580e3ffe62a2c5ea1c095b609b2943c5269"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5ebaa7c5f6f688959e8d40840b2249ede63b8ed"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: hci_event: Ignore multiple conn complete events", "id": "2347916", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347916"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-672", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: hci_event: Ignore multiple conn complete events\nWhen one of the three connection complete events is received multiple\ntimes for the same handle, the device is registered multiple times which\nleads to memory corruptions. Therefore, consequent events for a single\nconnection are ignored.\nThe conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET\nis introduced to identify new connections. To make sure the events do not\ncontain this or another invalid handle HCI_CONN_HANDLE_MAX and checks\nare introduced.\nBuglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497"], "name": "CVE-2022-49138", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49138\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49138\nhttps://lore.kernel.org/linux-cve-announce/2025022606-CVE-2022-49138-a241@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-12T22:45:13.481567+00:00", "updated": "2025-07-12T22:45:13.481621+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}