{
  "cveId": "CVE-2022-49470",
  "url": "https://patchblox.com/security/cve/CVE-2022-49470",
  "summary": "CVE-2022-49470 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49470, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: btmtksdio: fix use-after-free at btmt...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event  We should not access skb buffer data anymore after hci_recv_frame was called.  [   39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event\u002B0x1b0 [   39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker [   39.634962] Call trace: [   39.634974]  dump_backtrace\u002B0x0/0x3b8 [   39.634999]  show_stack\u002B0x20/0x2c [   39.635016]  dump_stack_lvl\u002B0x60/0x78 [   39.635040]  print_address_description\u002B0x70/0x2f0 [   39.635062]  kasan_report\u002B0x154/0x194 [   39.635079]  __asan_report_load1_noabort\u002B0x44/0x50 [   39.635099]  btmtksdio_recv_event\u002B0x1b0/0x1c4 [   39.635129]  btmtksdio_txrx_work\u002B0x6cc/0xac4 [   39.635157]  process_one_work\u002B0x560/0xc5c [   39.635177]  worker_thread\u002B0x7ec/0xcc0 [   39.635195]  kthread\u002B0x2d0/0x3d0 [   39.635215]  ret_from_fork\u002B0x10/0x20 [   39.635247] Allocated by task 0: [   39.635260] (stack is not available) [   39.635281] Freed by task 2392: [   39.635295]  kasan_save_stack\u002B0x38/0x68 [   39.635319]  kasan_set_track\u002B0x28/0x3c [   39.635338]  kasan_set_free_info\u002B0x28/0x4c [   39.635357]  ____kasan_slab_free\u002B0x104/0x150 [   39.635374]  __kasan_slab_free\u002B0x18/0x28 [   39.635391]  slab_free_freelist_hook\u002B0x114/0x248 [   39.635410]  kfree\u002B0xf8/0x2b4 [   39.635427]  skb_free_head\u002B0x58/0x98 [   39.635447]  skb_release_data\u002B0x2f4/0x410 [   39.635464]  skb_release_all\u002B0x50/0x60 [   39.635481]  kfree_skb\u002B0xc8/0x25c [   39.635498]  hci_event_packet\u002B0x894/0xca4 [bluetooth] [   39.635721]  hci_rx_work\u002B0x1c8/0x68c [bluetooth] [   39.635925]  process_one_work\u002B0x560/0xc5c [   39.635951]  worker_thread\u002B0x7ec/0xcc0 [   39.635970]  kthread\u002B0x2d0/0x3d0 [   39.635990]  ret_from_fork\u002B0x10/0x20 [   39.636021] The buggy address belongs to the object at ffffff80cf28a600                 which belongs to the cache kmalloc-512 of size 512 [   39.636039] The buggy address is located 13 bytes inside of                 512-byte region [ffffff80cf28a600, ffffff80cf28a800)",
  "published": "2025-02-26T07:01:23Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00313,
  "epssPercentile": 0.24389,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49470",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49470",
      "released": "2025-02-26T07:01:23Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49470",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49470",
      "released": "2025-02-26T07:01:23Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49470",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49470",
      "released": "2025-02-26T07:01:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}