CVE-2022-49555: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49555 affects the Linux kernel's Bluetooth HCI QCA driver. The vulnerability was discovered when investigating a crash report related to timer list corruption, which occurs when a timer is freed while still active. This issue specifically involves the improper use of del_timer() instead of del_timer_sync() in the hci_qca driver before freeing resources (Kernel Commit).

The vulnerability exists in the qca_close function within the drivers/bluetooth/hci_qca.c file. The issue stems from using del_timer() instead of del_timer_sync() for handling tx_idle_timer and wake_retrans_timer, while the wake_retrans_timer could potentially be rearmed via the work queue. The fix involves moving the destruction of the work queue before del_timer_sync() calls to prevent potential race conditions (Kernel Commit).

The vulnerability can lead to timer list corruption and system crashes when the affected timers are freed while still active. This particularly affects systems using the QCA Bluetooth chipset with UART interface (Kernel Commit).

The vulnerability can be triggered during the cleanup process of the Bluetooth HCI QCA driver, specifically when closing the connection. The issue requires access to a system with the affected driver and the ability to trigger the driver's cleanup routines (Kernel Commit).

The issue has been fixed by replacing del_timer() calls with del_timer_sync() and reorganizing the cleanup sequence in the qca_close function. The fix ensures proper synchronization when freeing timer resources and prevents potential race conditions. Users should update to a patched version of the Linux kernel that includes this fix (Kernel Commit).