CVE-2022-49470: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49470 affects the Linux kernel's Bluetooth subsystem, specifically the btmtksdio driver. The vulnerability was discovered in the btmtksdio_recv_event function where a use-after-free condition occurs when accessing skb buffer data after hci_recv_frame is called (Kernel Git).

The vulnerability exists in the btmtksdio_recv_event function where the code continues to access the skb buffer data through hdr->evt after calling hci_recv_frame, which may have already freed the buffer. This leads to a use-after-free condition where the code attempts to read from memory that has been deallocated (Kernel Git).

The use-after-free vulnerability could lead to memory corruption, system crashes, or potential privilege escalation in systems using the affected MediaTek Bluetooth SDIO devices (Kernel Git).

The vulnerability can be triggered during normal operation of MediaTek MT7663S and MT7668S SDIO Bluetooth devices, as demonstrated by the KASAN report showing the use-after-free occurring in the btmtksdio_recv_event function (Kernel Git).

The issue has been fixed by storing the event type in a local variable before calling hci_recv_frame, preventing access to the potentially freed buffer. The fix was committed to the Linux kernel and backported to stable kernel versions (Kernel Git).