« Volver al listado

CVE-2022-50833

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works

syzbot is reporting attempt to schedule hdev->cmd_work work from system_wq WQ into hdev->workqueue WQ which is under draining operation [1], for commit c8efcc2589464ac7 ("workqueue: allow chained queueing during destruction") does not allow such operation.

The check introduced by commit 877afadad2dce8aa ("Bluetooth: When HCI work queue is drained, only queue chained work") was incomplete.

Use hdev->workqueue WQ when queuing hdev->{cmd,ncmd}_timer works because hci_{cmd,ncmd}_timeout() calls queue_work(hdev->workqueue).

Leer descripción completaMostrar menos

Also, protect the queuing operation with RCU read lock in order to avoid calling queue_delayed_work() after cancel_delayed_work() completed.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-50833",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3b382555706558f5c0587862b6dc03e96a252bba",
              "lessThan": "c4635cf3d845a7324c25c52d549b70c8bd7ad4c7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
              "lessThan": "3c6b036fe5c8ed8b6c4cbdc03605929882907ef0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
              "lessThan": "deee93d13d385103205879a8a0915036ecd83261",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bf367fa1fefabdf14938d0ac9ed60020389112e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.19.2",
              "lessThan": "5.19.15",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.18.18",
              "lessThan": "5.19",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_event.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.19.15",
              "versionType": "semver",
              "lessThanOrEqual": "5.19.*"
            },
            {
              "status": "unaffected",
              "version": "6.0.1",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_event.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-30T13:15:57.810",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3c6b036fe5c8ed8b6c4cbdc03605929882907ef0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c4635cf3d845a7324c25c52d549b70c8bd7ad4c7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/deee93d13d385103205879a8a0915036ecd83261",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works\n\nsyzbot is reporting attempt to schedule hdev->cmd_work work from system_wq\nWQ into hdev->workqueue WQ which is under draining operation [1], for\ncommit c8efcc2589464ac7 (\"workqueue: allow chained queueing during\ndestruction\") does not allow such operation.\n\nThe check introduced by commit 877afadad2dce8aa (\"Bluetooth: When HCI work\nqueue is drained, only queue chained work\") was incomplete.\n\nUse hdev->workqueue WQ when queuing hdev->{cmd,ncmd}_timer works because\nhci_{cmd,ncmd}_timeout() calls queue_work(hdev->workqueue). Also, protect\nthe queuing operation with RCU read lock in order to avoid calling\nqueue_delayed_work() after cancel_delayed_work() completed."
    }
  ],
  "lastModified": "2026-06-17T05:24:15.947",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}