CVE-2022-49474

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-49474
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49474.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-49474
Downstream
DEBIAN (1)
SUSE (7)
UBUNTU (1)
Related
SUSE (7)
Published
2025-02-26T02:13:16Z
Modified
2026-10-20T10:30:32Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
Details

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout

Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:

dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49474.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
22c66af08230a7030bdb88accffaec3424695631
Fixed
9de3dc09e56f8deacd2bdbf4cecb71e11a312405
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0115a66ebb44bd9127ccb58cf43ed23c795eb1f0
Fixed
7d61dbd7311ab978d8ddac1749a758de4de00374
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bc4b08383046f3282b6fa58cfcef05bd13e52b93
Fixed
390d82733a953c1fabf3de9c9618091a7a9c90a6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5ccb04c6e1fb7b97fa2e1785b67c3a1cb3527ef7
Fixed
6f55fac0af3531cf60d11369454c41f5fc81ab3f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
059c2c09f4b7f97711d0d8eaa0b9877f5e7d0a75
Fixed
36c644c63bfcaee2d3a426f45e89a9cd09799318
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e1dee2c1de2b4dd00eb44004a4bda6326ed07b59
Fixed
65d347cb39e2e6bd0c2a745ad7c928998ebb0162
Fixed
537f619dea4e3fa8ed1f8f938abffe3615794bcc
Fixed
99df16007f4bbf9abfc3478cb17d10f0d7f8906e
Fixed
7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.9.283
Fixed
4.9.318
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.14.247
Fixed
4.14.283
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.19.207
Fixed
4.19.247
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.4.146
Fixed
5.4.198
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.65
Fixed
5.10.121
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.4.284
Fixed
4.5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.13.17
Fixed
5.14
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.14.4
Fixed
5.15
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
98ae477ed1540d3acbbf44d88ee237ad64275158
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f0c389e23e2475e5837716a629c81b7a9d90cc94
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0b9da4bde0d59c61b3675bdd80a05a726beb875a

Affected versions

v4.*
v4.14.247
v4.14.248
v4.14.249
v4.14.250
v4.14.251
v4.14.252
v4.14.253
v4.14.254
v4.14.255
v4.14.256
v4.14.257
v4.14.258
v4.14.259
v4.14.260
v4.14.261
v4.14.262
v4.14.263
v4.14.264
v4.14.265
v4.14.266
v4.14.267
v4.14.268
v4.14.269
v4.14.270
v4.14.271
v4.14.272
v4.14.273
v4.14.274
v4.14.275
v4.14.276
v4.14.277
v4.14.278
v4.14.279
v4.14.280
v4.14.281
v4.14.282
v4.19.207
v4.19.208
v4.19.209
v4.19.210
v4.19.211
v4.19.212
v4.19.213
v4.19.214
v4.19.215
v4.19.216
v4.19.217
v4.19.218
v4.19.219
v4.19.220
v4.19.221
v4.19.222
v4.19.223
v4.19.224
v4.19.225
v4.19.226
v4.19.227
v4.19.228
v4.19.229
v4.19.230
v4.19.231
v4.19.232
v4.19.233
v4.19.234
v4.19.235
v4.19.236
v4.19.237
v4.19.238
v4.19.239
v4.19.240
v4.19.241
v4.19.242
v4.19.243
v4.19.244
v4.19.245
v4.19.246
v4.4.284
v4.4.285
v4.4.286
v4.4.287
v4.4.288
v4.4.289
v4.4.290
v4.4.291
v4.4.292
v4.4.293
v4.4.294
v4.4.295
v4.4.296
v4.4.297
v4.4.298
v4.4.299
v4.4.300
v4.4.301
v4.4.302
v4.9.283
v4.9.284
v4.9.285
v4.9.286
v4.9.287
v4.9.288
v4.9.289
v4.9.290
v4.9.291
v4.9.292
v4.9.293
v4.9.294
v4.9.295
v4.9.296
v4.9.297
v4.9.298
v4.9.299
v4.9.300
v4.9.301
v4.9.302
v4.9.303
v4.9.304
v4.9.305
v4.9.306
v4.9.307
v4.9.308
v4.9.309
v4.9.310
v4.9.311
v4.9.312
v4.9.313
v4.9.314
v4.9.315
v4.9.316
v4.9.317
v5.*
v5.10.100
v5.10.101
v5.10.102
v5.10.103
v5.10.104
v5.10.105
v5.10.106
v5.10.107
v5.10.108
v5.10.109
v5.10.110
v5.10.111
v5.10.112
v5.10.113
v5.10.114
v5.10.115
v5.10.116
v5.10.117
v5.10.118
v5.10.119
v5.10.120
v5.10.65
v5.10.66
v5.10.67
v5.10.68
v5.10.69
v5.10.70
v5.10.71
v5.10.72
v5.10.73
v5.10.74
v5.10.75
v5.10.76
v5.10.77
v5.10.78
v5.10.79
v5.10.80
v5.10.81
v5.10.82
v5.10.83
v5.10.84
v5.10.85
v5.10.86
v5.10.87
v5.10.88
v5.10.89
v5.10.90
v5.10.91
v5.10.92
v5.10.93
v5.10.94
v5.10.95
v5.10.96
v5.10.97
v5.10.98
v5.10.99
v5.13.17
v5.13.18
v5.13.19
v5.14.10
v5.14.11
v5.14.12
v5.14.13
v5.14.14
v5.14.15
v5.14.16
v5.14.17
v5.14.18
v5.14.19
v5.14.20
v5.14.21
v5.14.4
v5.14.5
v5.14.6
v5.14.7
v5.14.8
v5.14.9
v5.4.146
v5.4.147
v5.4.148
v5.4.149
v5.4.150
v5.4.151
v5.4.152
v5.4.153
v5.4.154
v5.4.155
v5.4.156
v5.4.157
v5.4.158
v5.4.159
v5.4.160
v5.4.161
v5.4.162
v5.4.163
v5.4.164
v5.4.165
v5.4.166
v5.4.167
v5.4.168
v5.4.169
v5.4.170
v5.4.171
v5.4.172
v5.4.173
v5.4.174
v5.4.175
v5.4.176
v5.4.177
v5.4.178
v5.4.179
v5.4.180
v5.4.181
v5.4.182
v5.4.183
v5.4.184
v5.4.185
v5.4.186
v5.4.187
v5.4.188
v5.4.189
v5.4.190
v5.4.191
v5.4.192
v5.4.193
v5.4.194
v5.4.195
v5.4.196
v5.4.197

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49474.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.9.318
Type
ECOSYSTEM
Events
Introduced
4.10.0
Fixed
4.14.283
Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.247
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.198
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.121
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.46
Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
5.17.14
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.18.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49474.json"