CVE-2022-50447: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50447 is a NULL pointer dereference vulnerability in the Linux kernel's Bluetooth HCI subsystem, specifically in the hci_create_cis_sync function within the hci_conn module. It affects Linux kernel versions 6.0.x before 6.0.16 and 6.1.x before 6.1.2. The vulnerability was assigned a CVE identifier by kernel.org and published on October 1, 2025, with NVD initial analysis completed on January 16, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in the hci_create_cis_sync function of the Linux kernel Bluetooth stack. When a local user attempts to connect multiple ISO (Isochronous) sockets without using the DEFER_SETUP flag, the kernel dereferences a null pointer at offset 0x36, triggering a KASAN-detected crash in the hci_cmd_sync_work workqueue. Exploitation requires local access with low privileges and no user interaction; the attacker simply needs to initiate multiple ISO Bluetooth socket connections without the DEFER_SETUP option. Patches addressing this issue are available at three upstream kernel commits: 09a3b0c9, 50757a25, and a190cd9d (Red Hat Bugzilla, kernel.org patch 1).

Successful exploitation causes a kernel crash (denial of service), resulting in system instability and potential service interruption on affected Linux systems. The crash occurs in the Bluetooth HCI command synchronization work queue and is detectable via KASAN reporting. There is no confidentiality or integrity impact — the vulnerability is limited to availability, affecting any system running a vulnerable kernel version with Bluetooth ISO socket functionality accessible to low-privileged local users (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), reflecting very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface (Red Hat Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: KASAN: null-ptr-deref in hci_create_cis_sync+0x18b/0x2b0 or similar KASAN null pointer dereference reports.
• Logs: Kernel oops or panic messages referencing hci_cmd_sync_work, hci_create_cis_sync, or hci_conn in the Bluetooth subsystem.
• Process: Unexpected termination or crash of Bluetooth-related kernel worker threads (e.g., kworker/u3:1) associated with hci0 workqueue activity.

Update the Linux kernel to version 6.0.16 or later (for 6.0.x series) or 6.1.2 or later (for 6.1.x series). Red Hat has addressed this issue for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions via errata RHSA-2026:0534 and RHSA-2026:0535. As a workaround, restrict local user access to Bluetooth functionality if ISO socket connections are not required, or implement access controls limiting which users can create Bluetooth socket connections (Red Hat Bugzilla, Red Hat Errata).