CVE-2022-49910: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in the Linux kernel's Bluetooth L2CAP implementation (CVE-2022-49910). The vulnerability was disclosed on May 1, 2025, affecting the Linux kernel's Bluetooth subsystem. The issue occurs in the L2CAP (Logical Link Control and Adaptation Protocol) component due to a race condition between parallel flows involving l2cap_reassemble_sdu and bt_sock_recvmsg functions (NVD).

The vulnerability stems from a race condition between two parallel flows: 1) l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) -> __sock_queue_rcv_skb and 2) bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram. An SKB (socket buffer) can be queued by the first flow and immediately dequeued and freed by the second flow. After l2cap_reassemble_sdu returns, some code paths continue accessing struct l2cap_ctrl that resides in the freed SKB's CB, leading to a use-after-free condition (Red Hat).

The vulnerability could lead to a use-after-free condition in the Linux kernel's Bluetooth subsystem, potentially resulting in system crashes, memory corruption, or possible privilege escalation. The issue affects systems using the Linux kernel's Bluetooth functionality (NVD).

The vulnerability requires local access and can be triggered through the Bluetooth subsystem. Red Hat has assigned it a CVSS v3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating moderate severity with local access required (Red Hat).

The vulnerability has been resolved in the Linux kernel by fixing the race condition through keeping a local copy of struct l2cap_ctrl. Users are advised to update their Linux kernel to a version containing the fix (NVD).