{"id":"DEBIAN-CVE-2022-48878","details":"In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_qca: Fix driver shutdown on closed serdev  The driver shutdown callback (which sends EDL_SOC_RESET to the device over serdev) should not be invoked when HCI device is not open (e.g. if hci_dev_open_sync() failed), because the serdev and its TTY are not open either.  Also skip this step if device is powered off (qca_power_shutdown()).  The shutdown callback causes use-after-free during system reboot with Qualcomm Atheros Bluetooth:    Unable to handle kernel paging request at virtual address   0072662f67726fd7   ...   CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G        W   6.1.0-rt5-00325-g8a5f56bcfcca #8   Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)   Call trace:    tty_driver_flush_buffer+0x4/0x30    serdev_device_write_flush+0x24/0x34    qca_serdev_shutdown+0x80/0x130 [hci_uart]    device_shutdown+0x15c/0x260    kernel_restart+0x48/0xac  KASAN report:    BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50   Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1    CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted   6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28   Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)   Call trace:    dump_backtrace.part.0+0xdc/0xf0    show_stack+0x18/0x30    dump_stack_lvl+0x68/0x84    print_report+0x188/0x488    kasan_report+0xa4/0xf0    __asan_load8+0x80/0xac    tty_driver_flush_buffer+0x1c/0x50    ttyport_write_flush+0x34/0x44    serdev_device_write_flush+0x48/0x60    qca_serdev_shutdown+0x124/0x274    device_shutdown+0x1e8/0x350    kernel_restart+0x48/0xb0    __do_sys_reboot+0x244/0x2d0    __arm64_sys_reboot+0x54/0x70    invoke_syscall+0x60/0x190    el0_svc_common.constprop.0+0x7c/0x160    do_el0_svc+0x44/0xf0    el0_svc+0x2c/0x6c    el0t_64_sync_handler+0xbc/0x140    el0t_64_sync+0x190/0x194","modified":"2026-09-01T20:04:51.219197102Z","published":"2024-08-21T07:15:04.627Z","upstream":["CVE-2022-48878"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-48878"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48878.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48878.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-48878.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}