CVE-2022-3564 Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free

Medium 5.5 Published 17 Oct 2022 Updated 14 Oct 2026

A use-after-free vulnerability in the Linux Kernel Bluetooth subsystem allows attackers to potentially execute arbitrary code or cause a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-3564?

CVE-2022-3564 is a medium-severity use after free vulnerability in Debian Debian Linux, published on 17 Oct 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087.

Weakness: CWE-362, CWE-119

Which versions are affected by CVE-2022-3564?

It affects 6 products.

Linux distribution packages (40)

`kpatch-patch-3_10_0-1160_81_1` Red Hat:enterprise_linux:7::server	All versions	`0:1-3.el7`
`kpatch-patch-3_10_0-1160_81_1-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1-3.el7`
`kpatch-patch-3_10_0-1160_83_1` Red Hat:enterprise_linux:7::server	All versions	`0:1-2.el7`
`kpatch-patch-3_10_0-1160_83_1-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1-2.el7`
`kpatch-patch-3_10_0-1160_88_1` Red Hat:enterprise_linux:7::server	All versions	`0:1-1.el7`
`kpatch-patch-3_10_0-1160_88_1-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1-1.el7`
`kpatch-patch-3_10_0-1160_90_1` Red Hat:enterprise_linux:7::server	All versions	`0:1-1.el7`
`kpatch-patch-3_10_0-1160_90_1-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1-1.el7`
`kpatch-patch-3_10_0-1160_92_1` Red Hat:enterprise_linux:7::server	All versions	`0:1-1.el7`
`kpatch-patch-3_10_0-1160_92_1-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1-1.el7`
`kernel` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-abi-whitelists` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-debug` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-debug-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-debug-devel` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-devel` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-doc` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-tools` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-tools-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-tools-libs` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`kernel-tools-libs-devel` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`perf` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`perf-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`python-perf` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`python-perf-debuginfo` Red Hat:rhel_aus:7.4::server	All versions	`0:3.10.0-693.111.1.el7`
`bpftool` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-abi-whitelists` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-debug` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-debug-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-debug-devel` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-devel` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-doc` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-tools` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-tools-debuginfo` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`
`kernel-tools-libs` Red Hat:rhel_aus:7.6::server	All versions	`0:3.10.0-957.104.1.el7`

Products include Debian Debian Linux, Linux kernel, Netapp H300s Firmware, Netapp H410s Firmware, Netapp H500s Firmware, Netapp H700s Firmware.

How do I fix CVE-2022-3564?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2022-3564 being exploited?

There is no known exploitation of CVE-2022-3564 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-3564, GHSA-hjfq-c3jw-r92p, RHSA-2023:3277, RHSA-2023:3278, RHSA-2023:4020, RHSA-2023:4021 and 8 more.