PT-2025-8064 · Linux+5 · Linux Kernel+5

Luiz Augusto Von Dentz · Published 2022-01-01 · Updated 2026-05-26 · CVE-2022-49136

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A issue in the Linux kernel's Bluetooth handling has been identified, specifically in the hci sync function. The problem occurs when the HCI UNREGISTER flag is set, which indicates that hci unregister dev has been called. In this scenario, the hci cmd sync queue function should return an error to prevent a potential use-after-free (uaf) error after a timeout, as the hdev will have been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025:10669

ALSA-2025:10670

ALSA-2025_10669

ALSA-2025_10670

ALSA-2025_16880

BDU:2025-10589

CESA-2025_10669

CESA-2025_10670

CVE-2022-49136

INFSA-2025_10669

INFSA-2025_10670

RHSA-2023:2458

RHSA-2023_2458

RHSA-2025:10669

RHSA-2025:10670

RHSA-2025_10669

RHSA-2025_10670

SUSE-SU-2025:1176-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1241-1

Affected Products

Almalinux

Centos

Debian

Linux Kernel

Red Hat

Suse

References · 1316

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49136.json · Exploit
• https://bdu.fstec.ru/vul/2025-10589 · Security Note
• https://errata.almalinux.org/8/ALSA-2025-10669.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49136 · Security Note
• https://errata.almalinux.org/8/ALSA-2025-10670.html · Vendor Advisory
• https://git.kernel.org/stable/c/1c69ef84a808676cceb69210addf5df45b741323 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-49136 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49136 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49136 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:10669 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49136 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49136 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49136 · Vendor Advisory