CVE-2022-50447: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50447 is a vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_conn component. The vulnerability was discovered and disclosed on October 1, 2025, affecting the Linux kernel's Bluetooth connection handling functionality (NVD).

The vulnerability manifests as a null pointer dereference in the hcicreatecissync function when attempting to connect multiple ISO sockets without using DEFERSETUP. The issue has been assigned a CVSS v3.1 base score of 6.5 with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H, indicating local access requirements with high complexity (Red Hat).

When exploited, the vulnerability results in a kernel crash, as evidenced by the KASAN (Kernel Address Sanitizer) report showing a null pointer dereference. The crash occurs during the Bluetooth connection process, potentially affecting system stability and availability (NVD).

The vulnerability has been resolved in the Linux kernel through a patch that fixes the crash in hcicreatecis_sync. Various Linux distributions have incorporated this fix into their kernel updates (Ubuntu).