Loading story…
CVE-2022-45934 is an integer-overflow flaw in the Linux kernel Bluetooth L2CAP configuration-request handler, l2cap_config_req() in net/bluetooth/l2cap_core.c. A local or Bluetooth-adjacent attacker can repeatedly send crafted L2CAP_CONF_REQ packets until the unsigned 8-bit chan->num_conf_rsp counter wraps after 255 responses, potentially disrupting Bluetooth communications or crashing the affected system. Red Hat rates the issue Moderate with a CVSS 3.1 score of 6.5; NVD and CVE.org list 7.8.
Upstream commit ae4569813a6e931258db627cdfe50dfb4f917d5d prevents the wraparound by limiting counter increments to L2CAP_CONF_MAX_CONF_RSP. Red Hat shipped fixes for affected RHEL 8 and RHEL 9 kernel packages in RHSA-2024:2394, RHSA-2024:2950, and RHSA-2024:3138, while RHEL 9 kernel-rt remained affected and RHEL 6/7 were outside support scope. Organizations unable to patch can reduce exposure by disabling Bluetooth through kernel-module blocklisting, hardware controls, or BIOS settings.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat fixed CVE-2022-45934 in the RHEL 8 kernel through RHSA-2024:3138 and in the RHEL 8 kernel-rt through RHSA-2024:2950.
Red Hat addressed CVE-2022-45934 for the Red Hat Enterprise Linux 9 kernel through advisory RHSA-2024:2394.
Sungwoo Kim authored a patch to prevent chan->num_conf_rsp from wrapping when repeated L2CAP_CONF_REQ packets are processed, by capping increments at L2CAP_CONF_MAX_CONF_RSP.
Luiz Augusto von Dentz committed ae4569813a6e931258db627cdfe50dfb4f917d5d, fixing the unsigned 8-bit overflow in the Bluetooth L2CAP configuration-response counter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-3564** is a use-after-free flaw in the Linux kernel Bluetooth L2CAP implementation, in `l2cap_reassemble_sdu()` within `net/bluetooth/l2cap_core.c`. A local user or an attacker able to establish a Bluetooth connection can use two malicious L2CAP packet flows to trigger a race condition, potentially crashing the host or escalating privileges. Red Hat rates the issue CVSS 7.1; exploitation requires low privileges and winning a narrow timing window, and no practical exploit was known. The upstream fix is available in commit `89f9f3cb86b1c63badaf392a83dd661d56cc50b1`, with Fedora remediating it in Linux 6.0.8 stable updates and Red Hat issuing fixes for affected RHEL 7, 8, and 9 channels, including RHSA-2023:4150 and RHSA-2023:4151. Organizations unable to patch should disable Bluetooth at the hardware or BIOS level, or block Bluetooth kernel modules such as `bnep`, `bluetooth`, and `btusb` and disable the Bluetooth service.
Aug 26, 2026
A flaw in the Linux kernel's Bluetooth management (`MGMT`) component, tracked as **CVE-2026-43020**, was fixed after maintainers found that Long Term Key (`LTK`) `enc_size` values were not properly validated during load operations. An attacker with local low-privilege access could supply an `enc_size` larger than the 16-byte key buffer, allowing invalid data to be stored and later used in fixed-size stack operations when the kernel replied to LE LTK requests, creating a stack buffer overflow condition with denial-of-service and possible broader memory-corruption impact. The vulnerable code is in `net/bluetooth/mgmt.c` and has reportedly been present since Linux kernel 3.4. Upstream fixes were released across multiple stable branches, including 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0, by rejecting oversized `enc_size` values during management LTK record validation. Red Hat said fixes were issued for Red Hat Enterprise Linux 8, 9, and 10 through RHSA advisories, while RHEL 7, RHEL 7 `kernel-rt`, and RHEL 9 `kernel-rt` remained listed as affected at publication; RHEL 6 was listed as not affected because the vulnerable code is absent.
Aug 25, 2026
Red Hat released kernel and real-time kernel updates for **CVE-2023-40283**, a CVSS 7.8 use-after-free flaw in the Linux Bluetooth L2CAP socket-release routine, `l2cap_sock_release`. Improper handling of child sockets can allow a local low-privileged user to trigger the vulnerability, potentially compromising confidentiality, integrity, and availability. The upstream fix is commit `1728137b33c00d5a2b5110ed7aafb42e7c32e4a1`, included in Linux kernel 6.4.10; Red Hat reported no qualifying mitigation beyond updating affected systems. Affected Red Hat Enterprise Linux 8.4 support channels received kernel `4.18.0-305.130.1.el8_4` under RHSA-2024:2582, while relevant RHEL 8.4 real-time deployments received kernel-rt `4.18.0-305.130.1.rt7.206.el8_4` through RHSA-2024:2585. RHSA-2024:10772 also includes the remediation in kernel `5.14.0-284.95.1.el9_2` for RHEL 9.2 update channels. Administrators should install the applicable updated kernel packages and reboot to activate the fixes.
Aug 26, 2026