CVE-2022-3564

What it actually does

Use-after-free in l2cap_reassemble_sdu (net/bluetooth/l2cap_core.c) triggered by a race condition during Bluetooth L2CAP SDU reassembly, enabling memory corruption.

Why it matters to the business

Potential kernel-level compromise on systems exposing Bluetooth, risking full system takeover; low real-world risk given age, modest EPSS, and absence from known campaigns, but still requires attention in high-density kernel deployments.

How an attack unfolds

An attacker with local or adjacent Bluetooth access sends specially timed L2CAP packets to win the race in SDU reassembly, freeing a buffer that is later reused for arbitrary read/write or code execution.

How to fix it

Update wordpress/wordpress-develop (GIT) to commit 103a9a68afa1c7a743ff1c7f4881ceb051befed8 or later; rebuild and deploy the patched kernel image; disable Bluetooth when not required.

How to confirm the fix worked

Confirm the git commit hash in the deployed kernel source tree matches or supersedes 103a9a68afa1c7a743ff1c7f4881ceb051befed8; run kernel self-tests for L2CAP and inspect /proc/config.gz for Bluetooth options.

Typical attack path

1. Obtain local user access or adjacent Bluetooth proximity
2. Craft and transmit L2CAP packets to trigger concurrent reassembly
3. Trigger use-after-free to corrupt kernel memory structures
4. Escalate to ring-0 code execution or container escape

How to detect it

Review kernel audit logs and Bluetooth HCI traces for anomalous L2CAP reassembly events; search process and dmesg output for use-after-free warnings or crashes in l2cap_core.c around the time of suspected activity.

What your security team should do

• Prioritize patching kernel Bluetooth code on all internet-adjacent or multi-tenant hosts within 30 days
• Add the fixed commit to automated dependency and kernel build pipelines
• Disable Bluetooth HCI interfaces via kernel command-line or udev rules where not needed
• Monitor EPSS and threat-intel feeds for any future rise in exploitation maturity