CVE-2022-50833

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works syzbot is reporting attempt to schedule hdev->cmd_work work from system_wq WQ into hdev->workqueue WQ which is under draining operation [1], for commit c8efcc2589464ac7 ("workqueue: allow chained queueing during destruction") does not allow such operation. The check introduced by commit 877afadad2dce8aa ("Bluetooth: When HCI work queue is drained, only queue chained work") was incomplete. Use hdev->workqueue WQ when queuing hdev->{cmd,ncmd}_timer works because hci_{cmd,ncmd}_timeout() calls queue_work(hdev->workqueue). Also, protect the queuing operation with RCU read lock in order to avoid calling queue_delayed_work() after cancel_delayed_work() completed.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/3c6b036fe5c8ed8b6c4cbdc03605929882907ef0
https://git.kernel.org/stable/c/c4635cf3d845a7324c25c52d549b70c8bd7ad4c7
https://git.kernel.org/stable/c/deee93d13d385103205879a8a0915036ecd83261

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-30 13:15

Updated : 2026-06-17 05:24

NVD link : CVE-2022-50833

Mitre link : CVE-2022-50833

CVE.ORG link : CVE-2022-50833

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2022-50833", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3b382555706558f5c0587862b6dc03e96a252bba", "lessThan": "c4635cf3d845a7324c25c52d549b70c8bd7ad4c7", "versionType": "git"}, {"status": "affected", "version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e", "lessThan": "3c6b036fe5c8ed8b6c4cbdc03605929882907ef0", "versionType": "git"}, {"status": "affected", "version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e", "lessThan": "deee93d13d385103205879a8a0915036ecd83261", "versionType": "git"}, {"status": "affected", "version": "4bf367fa1fefabdf14938d0ac9ed60020389112e", "versionType": "git"}, {"status": "affected", "version": "5.19.2", "lessThan": "5.19.15", "versionType": "semver"}, {"status": "affected", "version": "5.18.18", "lessThan": "5.19", "versionType": "semver"}], "programFiles": ["net/bluetooth/hci_core.c", "net/bluetooth/hci_event.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "5.19.15", "versionType": "semver", "lessThanOrEqual": "5.19.*"}, {"status": "unaffected", "version": "6.0.1", "versionType": "semver", "lessThanOrEqual": "6.0.*"}, {"status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/hci_core.c", "net/bluetooth/hci_event.c"], "defaultStatus": "affected"}]}], "published": "2025-12-30T13:15:57.810", "references": [{"url": "https://git.kernel.org/stable/c/3c6b036fe5c8ed8b6c4cbdc03605929882907ef0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c4635cf3d845a7324c25c52d549b70c8bd7ad4c7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/deee93d13d385103205879a8a0915036ecd83261", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works\n\nsyzbot is reporting attempt to schedule hdev->cmd_work work from system_wq\nWQ into hdev->workqueue WQ which is under draining operation [1], for\ncommit c8efcc2589464ac7 (\"workqueue: allow chained queueing during\ndestruction\") does not allow such operation.\n\nThe check introduced by commit 877afadad2dce8aa (\"Bluetooth: When HCI work\nqueue is drained, only queue chained work\") was incomplete.\n\nUse hdev->workqueue WQ when queuing hdev->{cmd,ncmd}_timer works because\nhci_{cmd,ncmd}_timeout() calls queue_work(hdev->workqueue). Also, protect\nthe queuing operation with RCU read lock in order to avoid calling\nqueue_delayed_work() after cancel_delayed_work() completed."}], "lastModified": "2026-06-17T05:24:15.947", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}