CVE-2022-49555
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_qca: Use del_timer_sync() before freeing
While looking at a crash report on a timer list being corrupted, which usually happens when a timer is freed while still active. This is commonly triggered by code calling del_timer() instead of del_timer_sync() just before freeing.
One possible culprit is the hci_qca driver, which does exactly that.
Eric mentioned that wake_retrans_timer could be rearmed via the work queue, so also move the destruction of the work queue before del_timer_sync().
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.27%
- Percentil entre todas las CVEs puntuadas: 18
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/2717654ae022e6ea959a4b7b762702fe1a4690c2
- https://git.kernel.org/stable/c/37d17f63d085d601011964ade7371aeebeb6ed4b
- https://git.kernel.org/stable/c/4989bb03342941f2b730b37dfa38bce27b543661
- https://git.kernel.org/stable/c/72ef98445aca568a81c2da050532500a8345ad3a
- https://git.kernel.org/stable/c/db03727b4bbbbb36e6ef4cb655c670eefb6448e9
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-49555",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0ff252c1976da5d80db1377eb39b551931e61826",
"lessThan": "4989bb03342941f2b730b37dfa38bce27b543661",
"versionType": "git"
},
{
"status": "affected",
"version": "0ff252c1976da5d80db1377eb39b551931e61826",
"lessThan": "db03727b4bbbbb36e6ef4cb655c670eefb6448e9",
"versionType": "git"
},
{
"status": "affected",
"version": "0ff252c1976da5d80db1377eb39b551931e61826",
"lessThan": "37d17f63d085d601011964ade7371aeebeb6ed4b",
"versionType": "git"
},
{
"status": "affected",
"version": "0ff252c1976da5d80db1377eb39b551931e61826",
"lessThan": "2717654ae022e6ea959a4b7b762702fe1a4690c2",
"versionType": "git"
},
{
"status": "affected",
"version": "0ff252c1976da5d80db1377eb39b551931e61826",
"lessThan": "72ef98445aca568a81c2da050532500a8345ad3a",
"versionType": "git"
}
],
"programFiles": [
"drivers/bluetooth/hci_qca.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.120",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.45",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "5.17.13",
"versionType": "semver",
"lessThanOrEqual": "5.17.*"
},
{
"status": "unaffected",
"version": "5.18.2",
"versionType": "semver",
"lessThanOrEqual": "5.18.*"
},
{
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/bluetooth/hci_qca.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-02-26T07:01:31.313",
"references": [
{
"url": "https://git.kernel.org/stable/c/2717654ae022e6ea959a4b7b762702fe1a4690c2",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/37d17f63d085d601011964ade7371aeebeb6ed4b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4989bb03342941f2b730b37dfa38bce27b543661",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/72ef98445aca568a81c2da050532500a8345ad3a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db03727b4bbbbb36e6ef4cb655c670eefb6448e9",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_qca: Use del_timer_sync() before freeing\n\nWhile looking at a crash report on a timer list being corrupted, which\nusually happens when a timer is freed while still active. This is\ncommonly triggered by code calling del_timer() instead of\ndel_timer_sync() just before freeing.\n\nOne possible culprit is the hci_qca driver, which does exactly that.\n\nEric mentioned that wake_retrans_timer could be rearmed via the work\nqueue, so also move the destruction of the work queue before\ndel_timer_sync()."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: hci_qca: usar del_timer_sync() antes de liberar Al mirar un informe de fallas en una lista de temporizadores que se está corrompiendo, lo que generalmente sucede cuando se libera un temporizador mientras aún está activo. Esto se activa comúnmente por el código que llama a del_timer() en lugar de del_timer_sync() justo antes de liberar. Un posible culpable es el controlador hci_qca, que hace exactamente eso. Eric mencionó que wake_retrans_timer podría volver a armarse a través de la cola de trabajo, así que también mueva la destrucción de la cola de trabajo antes de del_timer_sync()."
}
],
"lastModified": "2026-08-04T10:17:51.303",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F54DF9A7-F274-4785-8B1B-D8C960AD1DA9",
"versionEndExcluding": "5.10.120",
"versionStartIncluding": "4.3"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08D699AD-F4CE-4BDD-A97E-4997299C7712",
"versionEndExcluding": "5.15.45",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "192FC54B-5367-49D6-B410-0285F14665B1",
"versionEndExcluding": "5.17.13",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FF255A1-64F4-4E31-AF44-C92FB8773BA2",
"versionEndExcluding": "5.18.2",
"versionStartIncluding": "5.18"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}