CVE-2022-49138

CVE-2022-49138 is a vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the handling of Host Controller Interface (HCI) events. The issue arises when the kernel receives multiple "connection complete" events for the same Bluetooth connection handle. In such cases, the kernel erroneously registers the same device multiple times, leading to memory corruption. This flaw could potentially be exploited to cause system instability or other unintended behaviors.

A moderate-impact flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) event handling as shipped in Red Hat Enterprise Linux 9 (kernel and kernel-rt). When one of the connection complete events is received multiple times for the same connection handle, the device is registered multiple times, which can lead to memory corruption in the kernel. An attacker able to trigger such duplicate events could use this flaw to cause a denial of service (system crash or instability); Red Hat rates this as a local attack vector requiring privileges, with impact limited to availability (CVSS 3.1 base score 5.5). Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 1 are not affected; in Red Hat In-Vehicle OS the vulnerable code is not present. On the affected RHEL 9 update streams the fix is deferred or delegated given the moderate severity and availability-only impact; the residual risk on deferred streams is that an attacker with the required local access and privileges could still trigger kernel memory corruption, while delegated streams are handled through the delegated process, with fixes pursued where the delegated resolution is AFFECTED. The upstream CVE.org record assigns a higher severity (Important, CVSS 3.1 base score 8.8, adjacent-network attack vector, no privileges required, high impact to confidentiality, integrity, and availability), which differs from Red Hat's Moderate rating of 5.5 based on a local, privilege-requiring attack vector with availability-only impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.