CVE-2022-50833: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50833 is a race condition vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the HCI (Host Controller Interface) workqueue handling. The flaw arises from an incomplete check when queuing hdev->{cmd,ncmd}_timer works, allowing an attempt to schedule work from system_wq into hdev->workqueue while the latter is under a draining operation — an operation disallowed since commit c8efcc2589464ac7. It affects Linux kernel versions from commit 877afadad2dce8aa up to the patched commits, with fixes backported to stable branches including 5.19.15, 6.0.1, and 6.1. The vulnerability was publicly disclosed on December 30, 2025, and carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362) in the Linux kernel Bluetooth HCI layer. When hci_{cmd,ncmd}_timeout() fires, it calls queue_work(hdev->workqueue), but the timer queuing code was incorrectly using system_wq instead of hdev->workqueue, violating workqueue chaining rules enforced since commit c8efcc2589464ac7. Additionally, the absence of an RCU read lock around the queue_delayed_work() call created a window where the function could be invoked after cancel_delayed_work() had already completed, leading to a use-after-free or invalid scheduling scenario. The fix ensures hdev->workqueue is used consistently for timer work queuing and wraps the operation in an RCU read lock (Red Hat Bugzilla). Exploitation requires local access with low privileges and high attack complexity, as it depends on precise timing of Bluetooth device teardown operations.

Successful exploitation of this vulnerability could result in high confidentiality, integrity, and availability impacts on the affected system, as reflected in the CVSS v3.1 score. A local attacker with low privileges could potentially trigger a kernel crash (denial of service) or, under specific race conditions, achieve privilege escalation or arbitrary code execution within the kernel context. The scope is limited to the local system, but kernel-level compromise could enable full system takeover (Red Hat Advisory, Red Hat Bugzilla).

The Linux kernel has released patches addressing this vulnerability across multiple stable branches. Fixed versions include kernel 5.19.15 (commit 3c6b036fe5c8ed8b6c4cbdc03605929882907ef0), 6.0.1 (commit c4635cf3d845a7324c25c52d549b70c8bd7ad4c7), and 6.1 (commit deee93d13d385103205879a8a0915036ecd83261). Users should update to a patched kernel version provided by their Linux distribution. As a temporary workaround, disabling Bluetooth functionality (e.g., unloading the bluetooth kernel module or blacklisting it) can reduce exposure on systems where Bluetooth is not required (Red Hat Bugzilla).