CVE-2022-49474 (GCVE-0-2022-49474)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-08-05 08:55
VLAI
Title
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace: dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:15 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 22c66af08230a7030bdb88accffaec3424695631 , < 9de3dc09e56f8deacd2bdbf4cecb71e11a312405 (git)
Affected: 0115a66ebb44bd9127ccb58cf43ed23c795eb1f0 , < 7d61dbd7311ab978d8ddac1749a758de4de00374 (git)
Affected: bc4b08383046f3282b6fa58cfcef05bd13e52b93 , < 390d82733a953c1fabf3de9c9618091a7a9c90a6 (git)
Affected: 5ccb04c6e1fb7b97fa2e1785b67c3a1cb3527ef7 , < 6f55fac0af3531cf60d11369454c41f5fc81ab3f (git)
Affected: 059c2c09f4b7f97711d0d8eaa0b9877f5e7d0a75 , < 36c644c63bfcaee2d3a426f45e89a9cd09799318 (git)
Affected: e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 , < 65d347cb39e2e6bd0c2a745ad7c928998ebb0162 (git)
Affected: e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 , < 537f619dea4e3fa8ed1f8f938abffe3615794bcc (git)
Affected: e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 , < 99df16007f4bbf9abfc3478cb17d10f0d7f8906e (git)
Affected: e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 , < 7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2 (git)
Affected: 98ae477ed1540d3acbbf44d88ee237ad64275158 (git)
Affected: f0c389e23e2475e5837716a629c81b7a9d90cc94 (git)
Affected: 0b9da4bde0d59c61b3675bdd80a05a726beb875a (git)
Affected: 4.9.283 , < 4.9.318 (semver)
Affected: 4.14.247 , < 4.14.283 (semver)
Affected: 4.19.207 , < 4.19.247 (semver)
Affected: 5.4.146 , < 5.4.198 (semver)
Affected: 5.10.65 , < 5.10.121 (semver)
Affected: 4.4.284 , < 4.5 (semver)
Affected: 5.13.17 , < 5.14 (semver)
Affected: 5.14.4 , < 5.15 (semver)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 4.9.318 , ≤ 4.9.* (semver)
Unaffected: 4.14.283 , ≤ 4.14.* (semver)
Unaffected: 4.19.247 , ≤ 4.19.* (semver)
Unaffected: 5.4.198 , ≤ 5.4.* (semver)
Unaffected: 5.10.121 , ≤ 5.10.* (semver)
Unaffected: 5.15.46 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:15:54.463749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:32.377Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9de3dc09e56f8deacd2bdbf4cecb71e11a312405",
              "status": "affected",
              "version": "22c66af08230a7030bdb88accffaec3424695631",
              "versionType": "git"
            },
            {
              "lessThan": "7d61dbd7311ab978d8ddac1749a758de4de00374",
              "status": "affected",
              "version": "0115a66ebb44bd9127ccb58cf43ed23c795eb1f0",
              "versionType": "git"
            },
            {
              "lessThan": "390d82733a953c1fabf3de9c9618091a7a9c90a6",
              "status": "affected",
              "version": "bc4b08383046f3282b6fa58cfcef05bd13e52b93",
              "versionType": "git"
            },
            {
              "lessThan": "6f55fac0af3531cf60d11369454c41f5fc81ab3f",
              "status": "affected",
              "version": "5ccb04c6e1fb7b97fa2e1785b67c3a1cb3527ef7",
              "versionType": "git"
            },
            {
              "lessThan": "36c644c63bfcaee2d3a426f45e89a9cd09799318",
              "status": "affected",
              "version": "059c2c09f4b7f97711d0d8eaa0b9877f5e7d0a75",
              "versionType": "git"
            },
            {
              "lessThan": "65d347cb39e2e6bd0c2a745ad7c928998ebb0162",
              "status": "affected",
              "version": "e1dee2c1de2b4dd00eb44004a4bda6326ed07b59",
              "versionType": "git"
            },
            {
              "lessThan": "537f619dea4e3fa8ed1f8f938abffe3615794bcc",
              "status": "affected",
              "version": "e1dee2c1de2b4dd00eb44004a4bda6326ed07b59",
              "versionType": "git"
            },
            {
              "lessThan": "99df16007f4bbf9abfc3478cb17d10f0d7f8906e",
              "status": "affected",
              "version": "e1dee2c1de2b4dd00eb44004a4bda6326ed07b59",
              "versionType": "git"
            },
            {
              "lessThan": "7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2",
              "status": "affected",
              "version": "e1dee2c1de2b4dd00eb44004a4bda6326ed07b59",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "98ae477ed1540d3acbbf44d88ee237ad64275158",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f0c389e23e2475e5837716a629c81b7a9d90cc94",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b9da4bde0d59c61b3675bdd80a05a726beb875a",
              "versionType": "git"
            },
            {
              "lessThan": "4.9.318",
              "status": "affected",
              "version": "4.9.283",
              "versionType": "semver"
            },
            {
              "lessThan": "4.14.283",
              "status": "affected",
              "version": "4.14.247",
              "versionType": "semver"
            },
            {
              "lessThan": "4.19.247",
              "status": "affected",
              "version": "4.19.207",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.198",
              "status": "affected",
              "version": "5.4.146",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.121",
              "status": "affected",
              "version": "5.10.65",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.284",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15",
              "status": "affected",
              "version": "5.14.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.318",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.318",
                  "versionStartIncluding": "4.9.283",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.283",
                  "versionStartIncluding": "4.14.247",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.19.207",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "5.4.146",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "5.10.65",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.284",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.14.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout\n\nConnecting the same socket twice consecutively in sco_sock_connect()\ncould lead to a race condition where two sco_conn objects are created\nbut only one is associated with the socket. If the socket is closed\nbefore the SCO connection is established, the timer associated with the\ndangling sco_conn object won\u0027t be canceled. As the sock object is being\nfreed, the use-after-free problem happens when the timer callback\nfunction sco_sock_timeout() accesses the socket. Here\u0027s the call trace:\n\ndump_stack+0x107/0x163\n? refcount_inc+0x1c/\nprint_address_description.constprop.0+0x1c/0x47e\n? refcount_inc+0x1c/0x7b\nkasan_report+0x13a/0x173\n? refcount_inc+0x1c/0x7b\ncheck_memory_region+0x132/0x139\nrefcount_inc+0x1c/0x7b\nsco_sock_timeout+0xb2/0x1ba\nprocess_one_work+0x739/0xbd1\n? cancel_delayed_work+0x13f/0x13f\n? __raw_spin_lock_init+0xf0/0xf0\n? to_kthread+0x59/0x85\nworker_thread+0x593/0x70e\nkthread+0x346/0x35a\n? drain_workqueue+0x31a/0x31a\n? kthread_bind+0x4b/0x4b\nret_from_fork+0x1f/0x30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is sco_sock_connect(), reached only via a local connect() on an AF_BLUETOOTH/BTPROTO_SCO socket. Adjacent Bluetooth peers cannot trigger this race; incoming SCO setup uses sco_conn_ready(), not sco_sock_connect().\nAC:L - The attacker controls both sides of the race by issuing concurrent connect() calls on the same socket (and can then close it). Per guidance, attacker-controlled races are AC:L; an HCI device being present is expected on the worst-case Bluetooth deployments (e.g., phones).\nPR:L - bt_sock_create()/sco_sock_create() impose no capability check for SCO sockets, so an unprivileged local user can create and connect them when an HCI device is up. This does not require real root or init-namespace admin rights.\nUI:N - Exploitation requires only attacker-controlled syscalls (socket/connect/close); no victim action is needed.\nS:U - This is a standard in-kernel use-after-free enabling local privilege escalation within the same host security authority, with no VM/IOMMU/sandbox boundary crossed.\nC:H - Use-after-free of the sock object in sco_sock_timeout (sock_hold and subsequent sk field access) can be leveraged for arbitrary kernel memory disclosure via reclaim/spray of the freed object.\nI:H - The same sock UAF provides a kernel write primitive (demonstrated as a KASAN use-after-free write on the refcount) and is exploitable for control-flow hijacking.\nA:H - The dangling timeout_work reliably touches a freed sock and causes a kernel oops/crash, as shown by the syzkaller KASAN report in sco_sock_timeout."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:20.366Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9de3dc09e56f8deacd2bdbf4cecb71e11a312405"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d61dbd7311ab978d8ddac1749a758de4de00374"
        },
        {
          "url": "https://git.kernel.org/stable/c/390d82733a953c1fabf3de9c9618091a7a9c90a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f55fac0af3531cf60d11369454c41f5fc81ab3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/36c644c63bfcaee2d3a426f45e89a9cd09799318"
        },
        {
          "url": "https://git.kernel.org/stable/c/65d347cb39e2e6bd0c2a745ad7c928998ebb0162"
        },
        {
          "url": "https://git.kernel.org/stable/c/537f619dea4e3fa8ed1f8f938abffe3615794bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/99df16007f4bbf9abfc3478cb17d10f0d7f8906e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2"
        }
      ],
      "title": "Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49474",
    "datePublished": "2025-02-26T02:13:16.679Z",
    "dateReserved": "2025-02-26T02:08:31.579Z",
    "dateUpdated": "2026-08-05T08:55:20.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49474",
      "date": "2026-08-14",
      "epss": "0.00276",
      "percentile": "0.19838"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49474\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:23.613\",\"lastModified\":\"2026-06-17T05:18:09.760\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout\\n\\nConnecting the same socket twice consecutively in sco_sock_connect()\\ncould lead to a race condition where two sco_conn objects are created\\nbut only one is associated with the socket. If the socket is closed\\nbefore the SCO connection is established, the timer associated with the\\ndangling sco_conn object won\u0027t be canceled. As the sock object is being\\nfreed, the use-after-free problem happens when the timer callback\\nfunction sco_sock_timeout() accesses the socket. Here\u0027s the call trace:\\n\\ndump_stack+0x107/0x163\\n? refcount_inc+0x1c/\\nprint_address_description.constprop.0+0x1c/0x47e\\n? refcount_inc+0x1c/0x7b\\nkasan_report+0x13a/0x173\\n? refcount_inc+0x1c/0x7b\\ncheck_memory_region+0x132/0x139\\nrefcount_inc+0x1c/0x7b\\nsco_sock_timeout+0xb2/0x1ba\\nprocess_one_work+0x739/0xbd1\\n? cancel_delayed_work+0x13f/0x13f\\n? __raw_spin_lock_init+0xf0/0xf0\\n? to_kthread+0x59/0x85\\nworker_thread+0x593/0x70e\\nkthread+0x346/0x35a\\n? drain_workqueue+0x31a/0x31a\\n? kthread_bind+0x4b/0x4b\\nret_from_fork+0x1f/0x30\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: se corrige el sco_conn colgante y el use-after-free en sco_sock_timeout Conectar el mismo socket dos veces consecutivas en sco_sock_connect() podr\u00eda provocar una condici\u00f3n de ejecuci\u00f3n en la que se crean dos objetos sco_conn pero solo uno est\u00e1 asociado con el socket. Si el socket se cierra antes de que se establezca la conexi\u00f3n SCO, el temporizador asociado con el objeto sco_conn colgante no se cancelar\u00e1. A medida que se libera el objeto sock, el problema de use-after-free ocurre cuando la funci\u00f3n de devoluci\u00f3n de llamada del temporizador sco_sock_timeout() accede al socket. Aqu\u00ed est\u00e1 el seguimiento de la llamada: dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30 \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/sco.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"22c66af08230a7030bdb88accffaec3424695631\",\"lessThan\":\"9de3dc09e56f8deacd2bdbf4cecb71e11a312405\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0115a66ebb44bd9127ccb58cf43ed23c795eb1f0\",\"lessThan\":\"7d61dbd7311ab978d8ddac1749a758de4de00374\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bc4b08383046f3282b6fa58cfcef05bd13e52b93\",\"lessThan\":\"390d82733a953c1fabf3de9c9618091a7a9c90a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5ccb04c6e1fb7b97fa2e1785b67c3a1cb3527ef7\",\"lessThan\":\"6f55fac0af3531cf60d11369454c41f5fc81ab3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"059c2c09f4b7f97711d0d8eaa0b9877f5e7d0a75\",\"lessThan\":\"36c644c63bfcaee2d3a426f45e89a9cd09799318\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1dee2c1de2b4dd00eb44004a4bda6326ed07b59\",\"lessThan\":\"65d347cb39e2e6bd0c2a745ad7c928998ebb0162\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1dee2c1de2b4dd00eb44004a4bda6326ed07b59\",\"lessThan\":\"537f619dea4e3fa8ed1f8f938abffe3615794bcc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1dee2c1de2b4dd00eb44004a4bda6326ed07b59\",\"lessThan\":\"99df16007f4bbf9abfc3478cb17d10f0d7f8906e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e1dee2c1de2b4dd00eb44004a4bda6326ed07b59\",\"lessThan\":\"7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"98ae477ed1540d3acbbf44d88ee237ad64275158\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f0c389e23e2475e5837716a629c81b7a9d90cc94\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b9da4bde0d59c61b3675bdd80a05a726beb875a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.9.283\",\"lessThan\":\"4.9.318\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.247\",\"lessThan\":\"4.14.283\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.207\",\"lessThan\":\"4.19.247\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.146\",\"lessThan\":\"5.4.198\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.65\",\"lessThan\":\"5.10.121\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.284\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.13.17\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.14.4\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/sco.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.318\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.283\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.247\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.198\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.121\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.46\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.14\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:15:54.463749Z\",\"id\":\"CVE-2022-49474\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.284\",\"versionEndExcluding\":\"4.5\",\"matchCriteriaId\":\"FA737495-79C0-44E9-9460-1B952324539D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.238\",\"versionEndExcluding\":\"4.9.318\",\"matchCriteriaId\":\"00BEF9C7-A165-4F9C-AB25-957923C10777\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.247\",\"versionEndExcluding\":\"4.14.283\",\"matchCriteriaId\":\"04E6F3D8-9994-4BD6-AC78-979F4425C845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.207\",\"versionEndExcluding\":\"4.19.247\",\"matchCriteriaId\":\"D758AE59-1429-4455-9E8F-244E41414654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.146\",\"versionEndExcluding\":\"5.4.198\",\"matchCriteriaId\":\"10513E44-520A-4056-98BE-E9AAC07D6139\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.65\",\"versionEndExcluding\":\"5.10.121\",\"matchCriteriaId\":\"54DD05A3-4198-4FF8-9B37-4C8B5C038E64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13.17\",\"versionEndExcluding\":\"5.14\",\"matchCriteriaId\":\"0547757C-4CB4-47A0-A6C4-2C6CDEA08791\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14.4\",\"versionEndExcluding\":\"5.15.46\",\"matchCriteriaId\":\"FCE27D56-8FE9-4B2F-93FE-BCAB349E9E3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"15E2DD33-2255-4B76-9C15-04FF8CBAB252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36c644c63bfcaee2d3a426f45e89a9cd09799318\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/390d82733a953c1fabf3de9c9618091a7a9c90a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/537f619dea4e3fa8ed1f8f938abffe3615794bcc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/65d347cb39e2e6bd0c2a745ad7c928998ebb0162\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f55fac0af3531cf60d11369454c41f5fc81ab3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d61dbd7311ab978d8ddac1749a758de4de00374\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/99df16007f4bbf9abfc3478cb17d10f0d7f8906e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9de3dc09e56f8deacd2bdbf4cecb71e11a312405\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:08:39+00:00",
      "cve": "CVE-2022-49474",
      "id": "CVE-2022-49474",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49474.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:13:40Z",
      "cve": "CVE-2022-49474",
      "id": "CVE-2022-49474",
      "initial_release_date": "2025-02-27T03:06:18Z",
      "product_status:known_affected": "360",
      "product_status:known_not_affected": "256",
      "product_status:recommended": "316",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49474",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49474.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49474\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:15:54.463749Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:15:56.136Z\"}}], \"cna\": {\"title\": \"Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"22c66af08230a7030bdb88accffaec3424695631\", \"lessThan\": \"9de3dc09e56f8deacd2bdbf4cecb71e11a312405\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0115a66ebb44bd9127ccb58cf43ed23c795eb1f0\", \"lessThan\": \"7d61dbd7311ab978d8ddac1749a758de4de00374\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bc4b08383046f3282b6fa58cfcef05bd13e52b93\", \"lessThan\": \"390d82733a953c1fabf3de9c9618091a7a9c90a6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5ccb04c6e1fb7b97fa2e1785b67c3a1cb3527ef7\", \"lessThan\": \"6f55fac0af3531cf60d11369454c41f5fc81ab3f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"059c2c09f4b7f97711d0d8eaa0b9877f5e7d0a75\", \"lessThan\": \"36c644c63bfcaee2d3a426f45e89a9cd09799318\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1dee2c1de2b4dd00eb44004a4bda6326ed07b59\", \"lessThan\": \"65d347cb39e2e6bd0c2a745ad7c928998ebb0162\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1dee2c1de2b4dd00eb44004a4bda6326ed07b59\", \"lessThan\": \"537f619dea4e3fa8ed1f8f938abffe3615794bcc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1dee2c1de2b4dd00eb44004a4bda6326ed07b59\", \"lessThan\": \"99df16007f4bbf9abfc3478cb17d10f0d7f8906e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e1dee2c1de2b4dd00eb44004a4bda6326ed07b59\", \"lessThan\": \"7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"98ae477ed1540d3acbbf44d88ee237ad64275158\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f0c389e23e2475e5837716a629c81b7a9d90cc94\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0b9da4bde0d59c61b3675bdd80a05a726beb875a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.9.283\", \"lessThan\": \"4.9.318\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.247\", \"lessThan\": \"4.14.283\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.207\", \"lessThan\": \"4.19.247\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.146\", \"lessThan\": \"5.4.198\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.65\", \"lessThan\": \"5.10.121\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.4.284\", \"lessThan\": \"4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.13.17\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.14.4\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/bluetooth/sco.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.318\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.283\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.247\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.121\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/bluetooth/sco.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9de3dc09e56f8deacd2bdbf4cecb71e11a312405\"}, {\"url\": \"https://git.kernel.org/stable/c/7d61dbd7311ab978d8ddac1749a758de4de00374\"}, {\"url\": \"https://git.kernel.org/stable/c/390d82733a953c1fabf3de9c9618091a7a9c90a6\"}, {\"url\": \"https://git.kernel.org/stable/c/6f55fac0af3531cf60d11369454c41f5fc81ab3f\"}, {\"url\": \"https://git.kernel.org/stable/c/36c644c63bfcaee2d3a426f45e89a9cd09799318\"}, {\"url\": \"https://git.kernel.org/stable/c/65d347cb39e2e6bd0c2a745ad7c928998ebb0162\"}, {\"url\": \"https://git.kernel.org/stable/c/537f619dea4e3fa8ed1f8f938abffe3615794bcc\"}, {\"url\": \"https://git.kernel.org/stable/c/99df16007f4bbf9abfc3478cb17d10f0d7f8906e\"}, {\"url\": \"https://git.kernel.org/stable/c/7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout\\n\\nConnecting the same socket twice consecutively in sco_sock_connect()\\ncould lead to a race condition where two sco_conn objects are created\\nbut only one is associated with the socket. If the socket is closed\\nbefore the SCO connection is established, the timer associated with the\\ndangling sco_conn object won\u0027t be canceled. As the sock object is being\\nfreed, the use-after-free problem happens when the timer callback\\nfunction sco_sock_timeout() accesses the socket. Here\u0027s the call trace:\\n\\ndump_stack+0x107/0x163\\n? refcount_inc+0x1c/\\nprint_address_description.constprop.0+0x1c/0x47e\\n? refcount_inc+0x1c/0x7b\\nkasan_report+0x13a/0x173\\n? refcount_inc+0x1c/0x7b\\ncheck_memory_region+0x132/0x139\\nrefcount_inc+0x1c/0x7b\\nsco_sock_timeout+0xb2/0x1ba\\nprocess_one_work+0x739/0xbd1\\n? cancel_delayed_work+0x13f/0x13f\\n? __raw_spin_lock_init+0xf0/0xf0\\n? to_kthread+0x59/0x85\\nworker_thread+0x593/0x70e\\nkthread+0x346/0x35a\\n? drain_workqueue+0x31a/0x31a\\n? kthread_bind+0x4b/0x4b\\nret_from_fork+0x1f/0x30\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.318\", \"versionStartIncluding\": \"4.9.283\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.283\", \"versionStartIncluding\": \"4.14.247\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.247\", \"versionStartIncluding\": \"4.19.207\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.198\", \"versionStartIncluding\": \"5.4.146\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.121\", \"versionStartIncluding\": \"5.10.65\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.46\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.14\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.3\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.4.284\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.13.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.14.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:22:21.227Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49474\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:22:21.227Z\", \"dateReserved\": \"2025-02-26T02:08:31.579Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:13:16.679Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.