CVE-2022-48971

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix not cleanup led when bt_init fails

bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it.

This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it:

BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= e64c97b53bc6727aa4385535166aaa047281e02d, < 8a66c3a94285552f6a8e45d73b34ebbad11d388b; >= e64c97b53bc6727aa4385535166aaa047281e02d, < 2c6cf0afc3856359e620e96edd952457d258e16c; >= e64c97b53bc6727aa4385535166aaa047281e02d, < e7b950458156d410509a08c41930b75e72985938; >= e64c97b53bc6727aa4385535166aaa047281e02d, < edf7284a98296369dd0891a0457eec37df244873; >= e64c97b53bc6727aa4385535166aaa047281e02d, < 5ecf7cd6fde5e72c87122084cf00d63e35d8dd9f; >= e64c97b53bc6727aa4385535166aaa047281e02d, < 2f3957c7eb4e07df944169a3e50a4d6790e1c744
LinuxLinux4.9

References

Timeline

Published
Oct 21, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-489725.5In the Linux kernel, the following vulnerability has been resolved: mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() Kernel faCVE-2022-489735.5In the Linux kernel, the following vulnerability has been resolved: gpio: amd8111: Fix PCI device reference count leak for_each_pci_dev() CVE-2022-489745.5In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix using __this_cpu_add in preemptible CurrentlCVE-2022-489755.5In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiochip_setup_dev() Here is a backtrace rCVE-2022-489765.5In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable_offload: fix using __this_cpu_add in preemptible CVE-2022-489775.5In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rcv_filter Analogue tCVE-2022-489785.5In the Linux kernel, the following vulnerability has been resolved: HID: core: fix shift-out-of-bounds in hid_report_raw_event Syzbot repoCVE-2022-489795.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix array index out of bound error in DCN32 DML [Why&CVE-2022-48985.4In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. ThiCVE-2022-489807.8In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policiCVE-2022-489817.8In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drm_gem_shmem_mmap()CVE-2022-489825.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging CSR fake controllers It seems fak
CVE-2022-48971: Medium severity, CVSS 5.5 | Vulnix