CVE-2022-42896

What it actually does

Use-after-free in l2cap_connect and l2cap_le_connect_req allows remote attackers within Bluetooth range to execute arbitrary code or leak kernel memory.

Why it matters to the business

Attackers can fully compromise affected Linux systems over short-range wireless, leading to data theft, ransomware deployment, or persistent access without user interaction.

How an attack unfolds

An attacker in Bluetooth proximity crafts malicious L2CAP connection requests that trigger the use-after-free in the kernel's Bluetooth stack, enabling code execution or memory disclosure.

How to fix it

Upgrade the Linux kernel to include commit 711f8c3fb3db61897080468586b970c87c61d9e4 or later; disable Bluetooth when not required.

How to confirm the fix worked

Verify the running kernel contains commit 711f8c3fb3db61897080468586b970c87c61d9e4; test Bluetooth L2CAP connection handling under controlled conditions.

Typical attack path

1. Position within Bluetooth range of target device
2. Send crafted L2CAP connect or LE connect request packets
3. Trigger use-after-free to corrupt kernel memory structures
4. Achieve arbitrary code execution or leak kernel memory contents

How to detect it

Review kernel logs for Bluetooth L2CAP errors, use-after-free warnings, or unexpected oops/panics involving net/bluetooth/l2cap_core.c; correlate with nearby device connection attempts.

What your security team should do

• Apply the referenced kernel commit immediately on all exposed systems
• Disable Bluetooth interfaces via kernel configuration or runtime controls where possible
• Monitor for new EPSS increases or public exploit releases
• Audit Bluetooth usage across the fleet and restrict to authorized devices only