CVE-2022-3564: Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
Modified
AliasesSUSE-SU-2023:0519-1SUSE-SU-2023:0525-1SUSE-SU-2023:0528-1SUSE-SU-2023:0552-1SUSE-SU-2023:0560-1RHSA-2023:3277RHSA-2023:3278RHSA-2023:4020RHSA-2023:4021RHSA-2023:4150RHSA-2023:4215UBUNTU-CVE-2022-3564DEBIAN-CVE-2022-3564
Published 17-10-2022Last modified 14-10-2026
Vulnerability summary
CVE-2022-3564 is a high (CVSS 7.1) vulnerability in debian debian_linux. EPSS estimates a 1.46% chance of exploitation in the next 30 days, higher than 73.4% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 5.5, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
7.1/10
010
High · v3.1 (NVD)EPSS score
1.46%
0%100%
Low · +0.11 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 61 · Related 37DLA-3244-1DLA-3245-1MGASA-2022-0442MGASA-2022-0443RHSA-2023:0856RHSA-2023:0858RHSA-2023:0951RHSA-2023:0979RHSA-2023:1008RHSA-2023:1202RHSA-2023:1203RHSA-2023:1220RHSA-2023:1221RHSA-2023:1251RHSA-2023:1435RHSA-2023:1559RHSA-2023:1560RHSA-2023:1666RHSA-2023:2736RHSA-2023:2951RHSA-2023:3388RHSA-2023:3431RHSA-2023:3491RHSA-2023:4151SUSE-SU-2023:0145-1SUSE-SU-2023:0146-1SUSE-SU-2023:0147-1SUSE-SU-2023:0148-1SUSE-SU-2023:0149-1SUSE-SU-2023:0152-1SUSE-SU-2023:0406-1SUSE-SU-2023:0407-1SUSE-SU-2023:0410-1SUSE-SU-2023:0420-1SUSE-SU-2023:0522-1SUSE-SU-2023:0547-1SUSE-SU-2023:0553-1SUSE-SU-2023:0562-1SUSE-SU-2023:0578-1SUSE-SU-2023:0591-1SUSE-SU-2023:0618-1SUSE-SU-2023:0637-1SUSE-SU-2025:01918-1SUSE-SU-2025:01966-1SUSE-SU-2025:01982-1SUSE-SU-2025:01983-1SUSE-SU-2025:01995-1SUSE-SU-2025:02173-1SUSE-SU-2025:02262-1USN-5755-1USN-5755-2USN-5756-1USN-5756-2USN-5756-3USN-5757-1USN-5757-2USN-5758-1USN-5773-1USN-5774-1USN-5779-1USN-5789-1
Timeline
- 17-10-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 5.9Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:NSourcesSingle source
High 7.1Preferred score · NVD (NIST)
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSources5 sources · 5.5–7.1
- CVE.orgCNA5.5MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · Red hatEcosystem advisory · calculated7.1HighCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.46%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
Increase +0.11 pp
From 1.34% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
Version check
Known conditions: adjacent network, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu92 products
- linuxAll versions (No fix recorded) | < 4.4.0-235.269 | < 4.15.0-200.211 | < 5.4.0-135.152 | < 5.15.0-56.62
- linux-aws< 4.4.0-1114.120 | < 4.4.0-1152.167 | < 4.15.0-1146.158 | < 5.4.0-1092.100 | < 5.15.0-1026.30
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
Redhat50 products
- bpftool< 0:3.10.0-1062.72.1.el7 | < 0:3.10.0-957.104.1.el7
- bpftool-debuginfo< 0:3.10.0-1062.72.1.el7
- kernel< 0:3.10.0-1062.72.1.el7 | < 0:3.10.0-693.111.1.el7 | < 0:3.10.0-957.104.1.el7
- kernel-abi-whitelists< 0:3.10.0-1062.72.1.el7 | < 0:3.10.0-693.111.1.el7 | < 0:3.10.0-957.104.1.el7
- kernel-bootwrapper< 0:3.10.0-1062.72.1.el7
Suse14 products
- kernel-livepatch-SLE15-SP1_Update_29&distro=SUSE Linux Enterprise Live Patching 15 SP1< 13-150100.2.2
- kernel-livepatch-SLE15-SP1_Update_30&distro=SUSE Linux Enterprise Live Patching 15 SP1< 12-150100.2.2
- kernel-livepatch-SLE15-SP1_Update_36&distro=SUSE Linux Enterprise Live Patching 15 SP1< 2-150100.2.1
- kernel-livepatch-SLE15-SP2_Update_25&distro=SUSE Linux Enterprise Live Patching 15 SP2< 17-150200.2.2
- kernel-livepatch-SLE15-SP2_Update_26&distro=SUSE Linux Enterprise Live Patching 15 SP2< 13-150200.2.2
Netapp4 products
Debian2 products
- linux< 6.0.8-1
- debian_linuxEOL10.0
Linux2 products
- kerneln/a
- linux_kernel≥ 3.6, < 4.9.333 | ≥ 4.10, < 4.14.299 | ≥ 4.15, < 4.19.265 | ≥ 4.20, < 5.4.224 | ≥ 5.5.0, < 5.10.154 | ≥ 5.11, < 5.15.78 | ≥ 5.16, < 6.0.8
6 vendors · 164 products
References
46 links- vuldb.com?id.211087Third Party Advisory
- security.netapp.com/advisory/ntap-20221223-0001/Third Party Advisory
