{"id":"DEBIAN-CVE-2022-49910","details":"In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu  Fix the race condition between the following two flows that run in parallel:  1. l2cap_reassemble_sdu -\u003e chan-\u003eops-\u003erecv (l2cap_sock_recv_cb) -\u003e    __sock_queue_rcv_skb.  2. bt_sock_recvmsg -\u003e skb_recv_datagram, skb_free_datagram.  An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2cap_reassemble_sdu can't use the SKB after that function returns. However, some places continue accessing struct l2cap_ctrl that resides in the SKB's CB for a short time after l2cap_reassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8).  Fix it by keeping a local copy of struct l2cap_ctrl.  BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169  Workqueue: hci0 hci_rx_work [bluetooth] Call Trace:  \u003cTASK\u003e  dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))  print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429)  ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth  kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493)  ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth  l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth  l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth  ret_from_fork (arch/x86/entry/entry_64.S:306)  \u003c/TASK\u003e  Allocated by task 43169:  kasan_save_stack (mm/kasan/common.c:39)  __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469)  kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293)  __alloc_skb (net/core/skbuff.c:414)  l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth  l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth  hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth  process_one_work (kernel/workqueue.c:2289)  worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437)  kthread (kernel/kthread.c:376)  ret_from_fork (arch/x86/entry/entry_64.S:306)  Freed by task 27920:  kasan_save_stack (mm/kasan/common.c:39)  kasan_set_track (mm/kasan/common.c:45)  kasan_set_free_info (mm/kasan/generic.c:372)  ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328)  slab_free_freelist_hook (mm/slub.c:1780)  kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553)  skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323)  bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth  l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth  sock_read_iter (net/socket.c:1087)  new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401)  vfs_read (fs/read_write.c:482)  ksys_read (fs/read_write.c:620)  do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)","modified":"2026-09-01T20:04:56.836679263Z","published":"2025-05-01T15:16:16.147Z","upstream":["CVE-2022-49910"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49910"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49910.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49910.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49910.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}