CVE-2022-49754

Bluetooth: Fix a buffer overflow in mgmt_mesh_add()

High7.8EPSS 0.21%

Published: 27 Mar 2025
Updated: 11 May 2026
Reserved: 27 Mar 2025
Assigned by: Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix a buffer overflow in mgmt_mesh_add() Smatch Warning: net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy() 'mesh_tx->param' too small (48 vs 50) Analysis: 'mesh_tx->param' is array of size 48. This is the destination. u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; // 19 + 29 = 48. But in the caller 'mesh_send' we reject only when len > 50. len > (MGMT_MESH_SEND_SIZE + 31) // 19 + 31 = 50.

Scores

CVSS scores of CVE-2022-49754, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.21% · top 88% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)All about CWE-120 and its CVEs

Affected products

Linux · Linux
- affected b338d91703fae6f6afd67f3f75caa3b8f36ddef3 – < ed818fd8c531abf561b379995ee7cc4c68029464
- affected b338d91703fae6f6afd67f3f75caa3b8f36ddef3 – < 2185e0fdbb2137f22a9dd9fcbf6481400d56299b
Linux · Linux
- affected 6.1
- unaffected < 6.1
- unaffected 6.1.9 – ≤ 6.1.*
- unaffected 6.2 – ≤ *

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-49754](https://trackcve.app/badge/CVE-2022-49754.svg)](https://trackcve.app/cve/CVE-2022-49754)

Record last updated 11 May 2026, 19:06 UTC.