CVE-2022-42896

Name: CVE-2022-42896
Creator: NVD / NIST
Published: 2022-11-23T15:15:10.723+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 2.01%

Last modified Jun 17, 2026

CVE-2022-42896 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url . EPSS estimates a 2.01% chance of exploitation in the next 30 days.

Description

There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

2.01%

78.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Linux	Linux Kernel	< 4.9.335
Linux	Linux Kernel	>= 4.10, < 4.14.301
Linux	Linux Kernel	>= 4.15, < 4.19.268
Linux	Linux Kernel	>= 4.20, < 5.4.226
Linux	Linux Kernel	>= 5.5, < 5.10.154
Linux	Linux Kernel	>= 5.11, < 5.15.78
Linux	Linux Kernel	>= 5.16, < 6.0.8

References

https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4Patch, Third Party Advisory
https://kernel.dance/#711f8c3fb3db61897080468586b970c87c61d9e4Patch, Vendor Advisory
https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4Patch, Third Party Advisory
https://kernel.dance/#711f8c3fb3db61897080468586b970c87c61d9e4Patch, Vendor Advisory

Timeline

Published: Nov 23, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-42896?

How severe is CVE-2022-42896?

CVE-2022-42896 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 2.01% probability of exploitation in the next 30 days.

How do I fix CVE-2022-42896?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-42896?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST