CVE-2022-3565 in Linux
Summary
by MITRE • 10/17/2022
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/17/2026
The vulnerability identified as CVE-2022-3565 represents a critical use-after-free condition within the Linux kernel's Bluetooth subsystem, specifically affecting the mISDN driver implementation. This flaw exists in the del_timer function located within drivers/isdn/mISDN/l1oip_core.c, making it a significant security concern for systems utilizing Bluetooth connectivity through the mISDN framework. The vulnerability stems from improper memory management practices where freed memory blocks are accessed after being deallocated, creating potential exploitation vectors for malicious actors seeking to compromise system integrity.
The technical implementation of this vulnerability occurs within the mISDN driver's timer management system, where the del_timer function fails to properly handle memory references after timer deletion operations. This use-after-free condition arises when the kernel's Bluetooth subsystem processes timer events in the l1oip_core.c file, allowing attackers to manipulate memory state through crafted Bluetooth communication sequences. The flaw is particularly dangerous because it operates at kernel level, providing potential attackers with direct access to system memory and execution capabilities that could lead to privilege escalation or system compromise.
The operational impact of CVE-2022-3565 extends beyond simple memory corruption, as it creates opportunities for arbitrary code execution within kernel space. Systems running affected Linux kernel versions with mISDN Bluetooth support become vulnerable to attacks that could result in complete system takeover, data exfiltration, or persistent backdoor establishment. This vulnerability particularly affects embedded systems, IoT devices, and servers that utilize Bluetooth connectivity through the mISDN protocol stack, making it a widespread concern across various deployment scenarios.
Security professionals should prioritize patching systems running affected kernel versions immediately, as the vulnerability's exploitation potential is high given its critical classification. The fix typically involves implementing proper memory management checks in the del_timer function to ensure that timer references are properly invalidated after deletion operations. Organizations should also consider implementing network segmentation and monitoring for suspicious Bluetooth traffic patterns that might indicate exploitation attempts, aligning with mitigation strategies recommended by the CWE (Common Weakness Enumeration) classification for use-after-free vulnerabilities. This vulnerability aligns with ATT&CK techniques related to privilege escalation and execution through kernel exploits, emphasizing the need for comprehensive system hardening and regular security updates to prevent potential exploitation.