CVE-2022-48971

What it actually does

Use-after-free in Bluetooth LED trigger registration: bt_init calls bt_leds_init but skips bt_leds_cleanup on later failure, leaving a freed "bluetooth-power" string that subsequent led_trigger_register accesses via strcmp, causing page fault.

Why it matters to the business

Linux systems using Bluetooth may experience kernel panics and crashes during module initialization or LED trigger operations, leading to downtime and reduced availability; widespread in kernel deployments with moderate downstream impact.

How an attack unfolds

An attacker triggers bt_init failure after LED registration (for example via misconfiguration or resource exhaustion), then initiates another led_trigger_register call that dereferences the dangling pointer, resulting in a crash. No public exploits or specific threat actors tied to this CVE.

How to fix it

Update Linux kernel to commit 8a66c3a94285552f6a8e45d73b34ebbad11d388b or later stable releases containing the fix; rebuild and reboot affected systems. For dependent packages apply the corresponding b0ab9d68a964cd3d74977f39a9e7af0a94509f7c change.

How to confirm the fix worked

Verify kernel source contains the cleanup call in bt_init error paths; confirm Bluetooth module loads without LED trigger leaks using dynamic analysis or code review of bt_leds_init/bt_leds_cleanup pairing.

Typical attack path

1. Trigger failure path in bt_init after bt_leds_init succeeds
2. Allow bt_leds_cleanup to be skipped leaving freed trigger data
3. Cause subsequent led_trigger_register or led_trigger_register_simple call
4. Trigger strcmp on dangling "bluetooth-power" pointer leading to page fault

How to detect it

Review kernel logs for BUG: unable to handle page fault and strcmp+0xc/0x30 traces involving led_trigger_register during Bluetooth init; inspect dmesg or journalctl for bt_init failure paths followed by LED registration attempts.

What your security team should do

• Apply the referenced kernel commit immediately on all affected Linux distributions
• Prioritize reboot after patching for Bluetooth-enabled hosts
• Monitor EPSS and kernel advisories for any increase in exploit maturity
• Test Bluetooth functionality post-update to ensure LED triggers behave correctly