CVE-2022-49111: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49111 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_send_acl function. The vulnerability was discovered when receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE events, where hci_conn_del was called without first verifying if conn->type is AMP_LINK and properly cleaning up upper layers with hci_disconn_cfm (Kernel Commit).

The vulnerability occurs in the Bluetooth subsystem's handling of physical link disconnection events. When an HCI_EV_DISCONN_PHY_LINK_COMPLETE event is received, the code fails to properly verify the connection type before deletion, leading to a use-after-free condition. The issue manifests when accessing memory at specific addresses after it has been freed, as demonstrated by KASAN (Kernel Address Sanitizer) reports showing invalid memory access (Kernel Commit).

This vulnerability could lead to use-after-free conditions in the kernel's Bluetooth subsystem, potentially resulting in system crashes, memory corruption, or possible privilege escalation. The issue affects systems using the Linux kernel's Bluetooth stack, particularly when handling AMP (Alternate MAC/PHY) link disconnections (Kernel Commit).

The vulnerability can be triggered through the Bluetooth subsystem when handling physical link disconnection events. It requires access to the Bluetooth subsystem and the ability to trigger disconnection events. The issue has been demonstrated through KASAN reports in testing environments (Kernel Commit).

The vulnerability has been fixed by adding proper type checking before calling hci_conn_del and ensuring proper cleanup of upper layers with hci_disconn_cfm. The fix involves modifying the hci_disconn_phylink_complete_evt function to verify that the connection type is AMP_LINK before proceeding with the deletion (Kernel Commit).