CVE-2022-3563: Linux Kernel BlueZ mgmt-tester.c read_50_controller_cap_complete null pointer dereference

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-17 · updated 2026-06-17
Weakness: CWE-404

Description

A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is recommended to apply a patch to fix this issue. VDB-211086 is the identifier assigned to this vulnerability.

Affected products

BlueZ: before 5.65 — fixed in 5.65

How to fix

Upgrade to a fixed version: BlueZ 5.65. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-3563 or the next vulnerability affects your stack