CVE-2022-49138 Bluetooth: hci_event: Ignore multiple conn complete events
A flaw in the Linux kernel Bluetooth subsystem allows memory corruption via duplicate connection events, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49138?
CVE-2022-49138 is a high-severity memory corruption vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: Ignore multiple conn complete events
When one of the three connection complete events is received multiple times for the same handle, the device is registered multiple times which leads to memory corruptions. Therefore, consequent events for a single connection are ignored.
The conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET is introduced to identify new connections. To make sure the events do not contain this or another invalid handle HCI_CONN_HANDLE_MAX and checks are introduced.
Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497
Weakness: CWE-476
Which versions are affected by CVE-2022-49138?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49138?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-49138 being exploited?
There is no known exploitation of CVE-2022-49138 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-67673, DEBIAN-CVE-2022-49138, GHSA-79x7-rvwv-cm9m, ROOT-OS-DEBIAN-11-CVE-2022-49138, ROOT-OS-UBUNTU-2204-CVE-2022-49138, UBUNTU-CVE-2022-49138.