In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set hci_cmd_sync_queue shall return an error if HCI_UNREGISTER flag has been set as that means hci_unregister_dev has been called so it will likely cause a uaf after the timeout as the hdev will be freed.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10669 advisory.

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)
      * kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CVE-2022-49136)
      * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10670 advisory.

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)
      * kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CVE-2022-49136)
      * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-10669 advisory.

    - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113]     {CVE-2022-49846}
    - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111}
    - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468]     {CVE-2022-49136}
    - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136}
    - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468]     {CVE-2022-49136}
    - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136}
    - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468]     {CVE-2022-49136}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10670 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CVE-2022-49136)

    * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10669 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth: Fix use after free in hci_send_acl (CVE-2022-49111)

    * kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CVE-2022-49136)

    * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1241-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
    - CVE-2022-49739: gfs2: Always check inode size of inline inodes (bsc#1240207).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
    - CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
    - CVE-2024-56651: can: hi311x: hi3110_can_ist(): fix potential use-after-free (bsc#1235528).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync     (bsc#1239095).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21693: mm: zswap: properly synchronize freeing resources during CPU hotunplug (bsc#1237029).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238911).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix queuing     commands when HCI_UNREGISTER is set hci_cmd_sync_queue shall return an error if HCI_UNREGISTER flag has     been set as that means hci_unregister_dev has been called so it will likely cause a uaf after the timeout     as the hdev will be freed. (CVE-2022-49136)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
241971	AlmaLinux 8 : kernel (ALSA-2025:10669)	Nessus	Alma Linux Local Security Checks	high
241970	AlmaLinux 8 : kernel-rt (ALSA-2025:10670)	Nessus	Alma Linux Local Security Checks	high
241687	Oracle Linux 8 : kernel (ELSA-2025-10669)	Nessus	Oracle Linux Local Security Checks	high
241616	RHEL 8 : kernel-rt (RHSA-2025:10670)	Nessus	Red Hat Local Security Checks	high
241613	RHEL 8 : kernel (RHSA-2025:10669)	Nessus	Red Hat Local Security Checks	high
234407	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1241-1)	Nessus	SuSE Local Security Checks	high
225339	Linux Distros Unpatched Vulnerability : CVE-2022-49136	Nessus	Misc.	high

Detections

Analytics

CVE-2022-49136

high

Tenable Plugins

high

high

high

high

high

high

high