Home

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works syzbot is reporting attempt to schedule hdev->cmd_work work from system_wq WQ into hdev->workqueue WQ which is under draining operation [1], for commit c8efcc2589464ac7 ("workqueue: allow chained queueing during destruction") does not allow such operation. The check introduced by commit 877afadad2dce8aa ("Bluetooth: When HCI work queue is drained, only queue chained work") was incomplete. Use hdev->workqueue WQ when queuing hdev->{cmd,ncmd}_timer works because hci_{cmd,ncmd}_timeout() calls queue_work(hdev->workqueue). Also, protect the queuing operation with RCU read lock in order to avoid calling queue_delayed_work() after cancel_delayed_work() completed.

PUBLISHED Reserved 2025-12-30 | Published 2025-12-30 | Updated 2025-12-30 | Assigner Linux

Product status

Default status
unaffected

3b382555706558f5c0587862b6dc03e96a252bba (git) before c4635cf3d845a7324c25c52d549b70c8bd7ad4c7
affected

877afadad2dce8aae1f2aad8ce47e072d4f6165e (git) before 3c6b036fe5c8ed8b6c4cbdc03605929882907ef0
affected

877afadad2dce8aae1f2aad8ce47e072d4f6165e (git) before deee93d13d385103205879a8a0915036ecd83261
affected

4bf367fa1fefabdf14938d0ac9ed60020389112e (git)
affected

Default status
affected

6.0
affected

Any version before 6.0
unaffected

5.19.15 (semver)
unaffected

6.0.1 (semver)
unaffected

6.1 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/c4635cf3d845a7324c25c52d549b70c8bd7ad4c7

git.kernel.org/...c/3c6b036fe5c8ed8b6c4cbdc03605929882907ef0

git.kernel.org/...c/deee93d13d385103205879a8a0915036ecd83261

cve.org (CVE-2022-50833)

nvd.nist.gov (CVE-2022-50833)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.