CVE-2022-50166
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's Bluetooth subsystem. When the HCI (Host Controller Interface) workqueue is drained to avoid deadlock, there is another delayed work that queues commands to this already drained workqueue. This causes a timeout error and a warning in the kernel logs, indicating that commands are being queued to a workqueue that is not accepting new work. The issue is fixed by adding a flag to prevent queuing timeout work while the command workqueue is draining.
How can this vulnerability impact me? :
This vulnerability can cause Bluetooth command timeouts and kernel warnings, potentially leading to degraded Bluetooth functionality or instability in the Linux system. It may result in Bluetooth commands not being processed correctly, which could affect devices relying on Bluetooth communication.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for specific error messages related to Bluetooth HCI workqueue timeouts and warnings. Look for log entries containing 'Bluetooth: hci2: command 0x040f tx timeout' and kernel warnings referencing 'workqueue.c' and '__queue_work'. You can use commands such as 'dmesg | grep -i bluetooth' or 'journalctl -k | grep -i bluetooth' to search for these messages in kernel logs.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix where the HCI workqueue draining behavior is corrected by adding the HCI_DRAIN_WQ flag to prevent queuing timeout work while the command workqueue is draining. If updating is not immediately possible, consider disabling Bluetooth functionality temporarily to avoid triggering the issue.