HighPublic exploit

Linux Kernel Bluetooth Socket Race Use-After-Free

IdentifiersCVE-2021-3752CWE-416· Use After Free

CVE-2021-3752 is a use-after-free vulnerability in the Linux kernel Bluetooth subsystem, affecting the lock_sock_nested() path. A race between connecting to a Bluetooth socket and disconnecting it can leave a socket object accessible after it has been freed. The issue was observed by KMSAN during execution of the l2cap_chan_timeout workqueue handler. The upstream correction is titled "Bluetooth: fix use-after-free error in lock_sock_nested()."

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

A local user able to trigger the race can crash the kernel, causing a denial of service. The memory-safety flaw may also permit partial local privilege escalation, with potential consequences for system confidentiality, integrity, and availability.

Mitigation

If you can’t patch tonight, do this now.

Where kernel updates cannot be immediately deployed, restrict untrusted local access and disable or limit Bluetooth functionality on systems that do not require it. No complete workaround is identified; applying the corrected kernel is required to remediate the defect.

Remediation

Patch, then assume compromise.

Install a Linux kernel package containing the upstream Bluetooth use-after-free fix. The fix was merged in Linux kernel 5.15 and was included in Debian Linux 5.10.84-1 and Fedora 5.15.3 stable updates. For affected Red Hat Enterprise Linux systems, apply the relevant vendor kernel security updates, including the fixes distributed through RHSA-2022:0620, RHSA-2022:0622, RHSA-2022:1975, or RHSA-2022:1988 as applicable, then reboot to run the updated kernel. Update dependent container images where they incorporate vulnerable kernel-related security content.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

DebianDebian Linuxoperating_system

Fedora ProjectFedoraapplication

LinuxLinux Kerneloperating_system

NetAppH300e Firmwareoperating_system

NetAppH300s Firmwareoperating_system

NetAppH410c Firmwareoperating_system

NetAppH410s Firmwareoperating_system

NetAppH500e Firmwareoperating_system

NetAppH500s Firmwareoperating_system

NetAppH700e Firmwareoperating_system

NetAppH700s Firmwareoperating_system

OracleCommunications Cloud Native Core Binding Support Functionapplication

OracleCommunications Cloud Native Core Network Exposure Functionapplication

OracleCommunications Cloud Native Core Policyapplication

Red Hat3scaleapplication

Red HatEnterprise Linuxoperating_system

Red HatEnterprise Linux For Real Timeoperating_system

Red HatEnterprise Linux For Real Time For Nfvoperating_system

Red HatVirtualization Hostapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

redhat accessNews

Jan 1, 2026

RHSA-2022:1975 - Security Advisory - Red Hat Customer Portal

Potential Linux kernel Bluetooth-module use-after-free vulnerability.

redhat accessNews

Jan 1, 2026

RHBA-2022:2229 - Bug Fix Advisory - Red Hat Customer Portal

Potential Linux kernel use-after-free vulnerability in the Bluetooth module.

redhat accessNews

Jan 1, 2026

RHBA-2022:4969 - Bug Fix Advisory - Red Hat Customer Portal

Linux kernel potential use-after-free vulnerability in the Bluetooth module.

redhat accessNews

Jan 1, 2026

RHBA-2022:5088 - Bug Fix Advisory - Red Hat Customer Portal

Linux kernel possible use-after-free vulnerability in the Bluetooth module.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity