VDB

UBUNTU-CVE-2022-3640

UBUNTU-CVE-2022-3640 PUBLISHED CVSS 8.800000190734863 HIGH

Record from OSV · Published October 21, 2022

A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
linux-ibm-5.4Ubuntu:18.04:LTS5.4.0-1044.49~18.04.1
linux-azure-fdeUbuntu:22.04:LTS5.15.0-1033.40.1
linux-azure-fipsUbuntu:Pro:FIPS-updates:20.04:LTS5.4.0-1103.109+fips1
linux-azure-5.4Ubuntu:18.04:LTS5.4.0-1103.109~18.04.1
linux-azureUbuntu:Pro:16.04:LTS4.15.0-1162.177~16.04.1
linux-awsUbuntu:Pro:16.04:LTS4.4.0-1183.198
linux-gkeUbuntu:20.04:LTS5.4.0-1094.101
linux-bluefieldUbuntu:Nvidia-BlueField:22.04:LTS5.15.0-1014.16
linux-ibmUbuntu:22.04:LTS5.15.0-1025.28
linux-awsUbuntu:18.04:LTS4.15.0-1151.164
linux-awsUbuntu:Pro:14.04:LTS4.4.0-1145.151
linux-bluefieldUbuntu:20.04:LTS5.4.0-1058.64

51 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
8.800000190734863
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersions
Ubuntu:18.04:LTSlinux-ibm-5.45.4.0-1026.29~18.04.1, 5.4.0-1029.33~18.04.1, 5.4.0-1031.35~18.04.1
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1029.36.1, 5.15.0-1024.30.1, 0
Ubuntu:Pro:FIPS-updates:20.04:LTSlinux-azure-fips0, 5.4.0-1022.22+fips1, 5.4.0-1073.76+fips1
Ubuntu:20.04:LTSlinux-oem-5.65.6.0-1021.21, 5.6.0-1055.59, 5.6.0-1054.58
Ubuntu:18.04:LTSlinux-azure-5.45.4.0-1073.76~18.04.1, 5.4.0-1040.42~18.04.1, 5.4.0-1039.41~18.04.1
Ubuntu:20.04:LTSlinux-raspi20, 5.4.0-1004.4, 5.3.0-1017.19
Ubuntu:Pro:16.04:LTSlinux-azure4.15.0-1041.45, 4.15.0-1042.46, 4.15.0-1045.49
Ubuntu:Pro:16.04:LTSlinux-aws4.4.0-1048.57, 0, 4.4.0-1001.10
Ubuntu:20.04:LTSlinux-gcp-5.135.13.0-1019.23~20.04.1, 5.13.0-1015.18~20.04.1, 5.13.0-1013.16~20.04.1
Ubuntu:22.04:LTSlinux-nvidia-6.20, 6.2.0-1013.13, 6.2.0-1012.12
Ubuntu:20.04:LTSlinux-gke5.4.0-1052.55, 5.4.0-1068.71, 5.4.0-1067.70
Ubuntu:20.04:LTSlinux-azure-5.85.8.0-1033.35~20.04.1, 5.8.0-1039.42~20.04.1, 5.8.0-1040.43~20.04.1
Ubuntu:Nvidia-BlueField:22.04:LTSlinux-bluefield5.15.0-1011.13, 0
Ubuntu:22.04:LTSlinux-ibm5.15.0-1018.21, 5.15.0-1017.20, 5.15.0-1022.25
Ubuntu:20.04:LTSlinux-aws-5.80, 5.8.0-1042.44~20.04.1, 5.8.0-1041.43~20.04.1
Ubuntu:18.04:LTSlinux-aws4.15.0-1054.56, 4.15.0-1056.58, 4.15.0-1057.59
Ubuntu:Pro:14.04:LTSlinux-aws4.4.0-1034.37, 4.4.0-1086.90, 4.4.0-1085.89
Ubuntu:20.04:LTSlinux-bluefield5.4.0-1036.39, 5.4.0-1054.60, 5.4.0-1040.44
Ubuntu:20.04:LTSlinux-intel-iotg-5.155.15.0-1003.5~20.04.1, 5.15.0-1010.14~20.04.1, 5.15.0-1015.20~20.04.2
Ubuntu:18.04:LTSlinux-oem4.15.0-1013.16, 4.15.0-1103.114, 4.15.0-1102.113

…and 106 more

Timeline

  • Oct 21, 2022 CVE Published
  • Oct 5, 2026 CVE Updated
  • Oct 30, 2026 Distribution Patch (23 in total, the first dated here)
  • Oct 30, 2026 Security Advisory (23 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln UBUNTU-CVE-2022-3640
vulnetix vdb fixes UBUNTU-CVE-2022-3640

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/UBUNTU-CVE-2022-3640/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 6 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›