CVE-2022-49754

Bluetooth: Fix a buffer overflow in mgmt_mesh_add()

State: Published
Severity: 7.8 High
Published: Mar 27, 2025
Updated: May 11, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix a buffer overflow in mgmt_mesh_add()

Smatch Warning: net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy() 'mesh_tx->param' too small (48 vs 50)

Analysis:

'mesh_tx->param' is array of size 48. This is the destination. u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; // 19 + 29 = 48.

But in the caller 'mesh_send' we reject only when len > 50. len > (MGMT_MESH_SEND_SIZE + 31) // 19 + 31 = 50.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

Product	Versions
LinuxLinux	b338d91703fae6f6afd67f3f75caa3b8f36ddef3 to before ed818fd8c531abf561b379995ee7cc4c68029464Affected b338d91703fae6f6afd67f3f75caa3b8f36ddef3 to before 2185e0fdbb2137f22a9dd9fcbf6481400d56299bAffected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.9 through 6.1.*Not affected 6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.