In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix dangling scoconn and use-after-free in scosock_timeout
Connecting the same socket twice consecutively in scosockconnect() could lead to a race condition where two scoconn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling scoconn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function scosocktimeout() accesses the socket. Here's the call trace:
dumpstack+0x107/0x163 ? refcountinc+0x1c/ printaddressdescription.constprop.0+0x1c/0x47e ? refcountinc+0x1c/0x7b kasanreport+0x13a/0x173 ? refcountinc+0x1c/0x7b checkmemoryregion+0x132/0x139 refcountinc+0x1c/0x7b scosocktimeout+0xb2/0x1ba processonework+0x739/0xbd1 ? canceldelayedwork+0x13f/0x13f ? _rawspinlockinit+0xf0/0xf0 ? tokthread+0x59/0x85 workerthread+0x593/0x70e kthread+0x346/0x35a ? drainworkqueue+0x31a/0x31a ? kthreadbind+0x4b/0x4b retfromfork+0x1f/0x30
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-0c1f1d1f",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f55fac0af3531cf60d11369454c41f5fc81ab3f",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-153a72f7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65d347cb39e2e6bd0c2a745ad7c928998ebb0162",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-1907033a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d61dbd7311ab978d8ddac1749a758de4de00374",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-2d10e9f8",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@390d82733a953c1fabf3de9c9618091a7a9c90a6",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-2db5c0d1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99df16007f4bbf9abfc3478cb17d10f0d7f8906e",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-3e1f3aac",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@537f619dea4e3fa8ed1f8f938abffe3615794bcc",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-45689c41",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d61dbd7311ab978d8ddac1749a758de4de00374",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-53a2ec54",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36c644c63bfcaee2d3a426f45e89a9cd09799318",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-561d7de5",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-5f1cdfca",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36c644c63bfcaee2d3a426f45e89a9cd09799318",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-737a1fc8",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@537f619dea4e3fa8ed1f8f938abffe3615794bcc",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-80ffc731",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f55fac0af3531cf60d11369454c41f5fc81ab3f",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-91e610e6",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99df16007f4bbf9abfc3478cb17d10f0d7f8906e",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-bdcc8c44",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9de3dc09e56f8deacd2bdbf4cecb71e11a312405",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-c32bf77c",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-c4f755b7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9de3dc09e56f8deacd2bdbf4cecb71e11a312405",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90495797827079792904289439572375224447",
                "66591137470218658405456627373273475494",
                "100945182260703193790639316459013015338",
                "191301409197915656695670155660726338001",
                "235148925960550454440896562995006664448",
                "256468593363553960503840233650430014852",
                "271907409449345322506326125918011183439",
                "228304942445643770452919844461270984903",
                "37170562933951410156408441418847717948",
                "289748283351716222784000241647650174799",
                "26673321220594216792495273356229967901",
                "26654112802851634388922839033650728725"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-c6334fae",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65d347cb39e2e6bd0c2a745ad7c928998ebb0162",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "269999511473334064600876385142241656264",
            "length": 867.0
        },
        "target": {
            "function": "sco_sock_connect",
            "file": "net/bluetooth/sco.c"
        },
        "id": "CVE-2022-49474-e25bc36a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@390d82733a953c1fabf3de9c9618091a7a9c90a6",
        "signature_type": "Function"
    }
]