What’s Vulnerable › Vulnerabilities

CVE-2022-3640: Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-10-21 · updated 2026-06-17
• Weakness: CWE-119

Description

A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.

Affected products

• Debian Linux: 10.0
• Fedoraproject Fedora: 35, 36, 37
• Linux kernel: from 4.9.326 before 4.9.333; from 4.14.291 before 4.14.299; from 4.19.255 before 4.19.265; from 5.4.209 before 5.4.224; from 5.10.135 before 5.10.154; from 5.15.59 before 5.15.79 — fixed in 4.14.299, 4.19.265, 4.9.333, 5.10.154, 5.15.79, 5.4.224

How to fix

Upgrade to a fixed version: Linux kernel 4.14.299, 4.19.265, 4.9.333, 5.10.154. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=42cf46dea905a80f6de218e837ba4d4cc33d6979
• https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
• https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGOIRR72OAFE53XZRUDZDP7INGLIC3E3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD7VWUT7YAU4CJ247IF44NGVOAODAJGC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG2UPX3MQ7RKRJEUMGEH2TLPKZJCBU5C/
• https://vuldb.com/?id.211944
• https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=42cf46dea905a80f6de218e837ba4d4cc33d6979
• https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
• https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGOIRR72OAFE53XZRUDZDP7INGLIC3E3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD7VWUT7YAU4CJ247IF44NGVOAODAJGC/

Get alerted when CVE-2022-3640 or the next vulnerability affects your stack