8.8

CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free

Modified
AliasesSUSE-SU-2025:3684-1UBUNTU-CVE-2022-50386DEBIAN-CVE-2022-50386
Published 18-09-2025Last modified 05-08-2026

Vulnerability summary

CVE-2022-50386 is a high (CVSS 8.8) Use After Free vulnerability in linux. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.37%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 25 · Related 13
RHSA-2025:19102RHSA-2025:19103RHSA-2025:21083RHSA-2025:21091RHSA-2025:21136RHSA-2025:22006

Timeline

  1. 18-09-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu120 products
  • linuxAll versions (No fix recorded) | < 4.15.0-204.215 | < 5.4.0-139.156 | < 5.15.0-60.66
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1150.163 | < 5.4.0-1096.104 | < 5.15.0-1030.34
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < 11e40d6c0823f699d8ad501e48d1c3ae4be386cd | ≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < 843fc4e386dd84b806a7f07fb062d8c3a44e5364 | ≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < d91fc2836562f299f34e361e089e9fe154da4f73 | ≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < 7d6f9cb24d2b2f6b6370eac074e2e6b1bafdad45 | ≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < 0c108cf3ad386e0084277093b55a351c49e0be27 | ≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < d1e894f950ad48897d1a7cb05909ea29d8c3810e | ≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < 6ffde6e03085874ae22263ff4cef4869f797e84f | ≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < 15fc21695eb606bdc5d483b92118ee42610a952d | ≥ 3df91ea20e744344100b10ae69a17211fcf5b207, < 35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f | 3.4
  • linux_kernel< 4.9.331 | ≥ 4.10, < 4.14.296 | ≥ 4.15, < 4.19.262 | ≥ 4.20, < 5.4.220 | ≥ 5.5, < 5.10.150 | ≥ 5.11, < 5.15.75 | ≥ 5.16, < 5.19.17 | ≥ 6.0, < 6.0.3
Debian1 product
  • linux< 6.0.3-1
Suse1 product
  • kgraft-patch-SLE12-SP5_Update_72&distro=SUSE Linux Enterprise Live Patching 12 SP5< 2-2.1

4 vendors · 124 products

References

16 links
Show all 16 references