CVE-2022-42896: Info Leak in l2cap_core in the Linux Kernel
Last updated 25 April 2025
Other sources
Linux Kernel could allow a remote attacker from within the local network to execute arbitrary code on the system, caused by multiple use-after-free vulnerabilities in the net/bluetooth/l2capcore.c's l2capconnect and l2capleconnectreq functions. By using Bluetooth within proximity of the victim, an attacker could exploit this vulnerability to execute arbitrary code on the system and leak kernel memory.
— IBM
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2capcore.c's l2capconnect and l2capleconnectreq functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim.
References:
https://github.com/google/security-research/security/advisories/GHSA-pf87-6c9q-jvm4 https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://github.com/torvalds/linux/commit/f937b758a188d6fd328a81367087eddbb2fce50f
— Red Hat
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2capcore.c's l2capconnect and l2capleconnectreq functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim.
We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-42896?
CVE-2022-42896 is a high-severity vulnerability that could allow remote code execution due to use-after-free vulnerabilities in the Linux Kernel.
How do I fix CVE-2022-42896?
To fix CVE-2022-42896, upgrade to versions 6.1 or higher of the Linux Kernel or apply vendor-specific patches for affected software.
Which versions of the Linux Kernel are affected by CVE-2022-42896?
CVE-2022-42896 affects various versions of the Linux Kernel from 4.10 up to, but not including, 6.1.
Can CVE-2022-42896 be exploited remotely?
Yes, CVE-2022-42896 can be exploited by remote attackers within the local network to execute arbitrary code.
What components are impacted by CVE-2022-42896?
CVE-2022-42896 impacts the Bluetooth stack, specifically the l2cap_connect and l2cap_le_connect_req functions in the Linux Kernel.