CVE-2022-50833 Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works
A race condition in the Linux kernel Bluetooth subsystem allows attackers to cause a denial of service via improper workqueue scheduling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50833?
CVE-2022-50833 is a vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works
syzbot is reporting attempt to schedule hdev->cmd_work work from system_wq WQ into hdev->workqueue WQ which is under draining operation [1], for commit c8efcc2589464ac7 ("workqueue: allow chained queueing during destruction") does not allow such operation.
The check introduced by commit 877afadad2dce8aa ("Bluetooth: When HCI work queue is drained, only queue chained work") was incomplete.
Use hdev->workqueue WQ when queuing hdev->{cmd,ncmd}_timer works because hci_{cmd,ncmd}_timeout() calls queue_work(hdev->workqueue). Also, protect the queuing operation with RCU read lock in order to avoid calling queue_delayed_work() after cancel_delayed_work() completed.
Which versions are affected by CVE-2022-50833?
How do I fix CVE-2022-50833?
Apply the vendor's patch.
Is CVE-2022-50833 being exploited?
There is no known exploitation of CVE-2022-50833 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50833, GHSA-rxjc-h4m5-gvq8, UBUNTU-CVE-2022-50833.