{
  "cveId": "CVE-2022-48878",
  "url": "https://patchblox.com/security/cve/CVE-2022-48878",
  "summary": "CVE-2022-48878 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48878, released August 21, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_qca: Fix driver shutdown on close...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_qca: Fix driver shutdown on closed serdev  The driver shutdown callback (which sends EDL_SOC_RESET to the device over serdev) should not be invoked when HCI device is not open (e.g. if hci_dev_open_sync() failed), because the serdev and its TTY are not open either.  Also skip this step if device is powered off (qca_power_shutdown()).  The shutdown callback causes use-after-free during system reboot with Qualcomm Atheros Bluetooth:    Unable to handle kernel paging request at virtual address   0072662f67726fd7   ...   CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G        W   6.1.0-rt5-00325-g8a5f56bcfcca #8   Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)   Call trace:    tty_driver_flush_buffer\u002B0x4/0x30    serdev_device_write_flush\u002B0x24/0x34    qca_serdev_shutdown\u002B0x80/0x130 [hci_uart]    device_shutdown\u002B0x15c/0x260    kernel_restart\u002B0x48/0xac  KASAN report:    BUG: KASAN: use-after-free in tty_driver_flush_buffer\u002B0x1c/0x50   Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1    CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted   6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28   Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)   Call trace:    dump_backtrace.part.0\u002B0xdc/0xf0    show_stack\u002B0x18/0x30    dump_stack_lvl\u002B0x68/0x84    print_report\u002B0x188/0x488    kasan_report\u002B0xa4/0xf0    __asan_load8\u002B0x80/0xac    tty_driver_flush_buffer\u002B0x1c/0x50    ttyport_write_flush\u002B0x34/0x44    serdev_device_write_flush\u002B0x48/0x60    qca_serdev_shutdown\u002B0x124/0x274    device_shutdown\u002B0x1e8/0x350    kernel_restart\u002B0x48/0xb0    __do_sys_reboot\u002B0x244/0x2d0    __arm64_sys_reboot\u002B0x54/0x70    invoke_syscall\u002B0x60/0x190    el0_svc_common.constprop.0\u002B0x7c/0x160    do_el0_svc\u002B0x44/0xf0    el0_svc\u002B0x2c/0x6c    el0t_64_sync_handler\u002B0xbc/0x140    el0t_64_sync\u002B0x190/0x194",
  "published": "2024-08-21T07:15:04Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00241,
  "epssPercentile": 0.15367,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.8-1",
      "fix": "DEBIAN-CVE-2022-48878",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48878",
      "released": "2024-08-21T07:15:04Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.8-1",
      "fix": "DEBIAN-CVE-2022-48878",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48878",
      "released": "2024-08-21T07:15:04Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.8-1",
      "fix": "DEBIAN-CVE-2022-48878",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48878",
      "released": "2024-08-21T07:15:04Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}