CVE-2022-50833

The vulnerability is a workqueue usage issue in the Linux kernel's Bluetooth subsystem, specifically during device destruction. The function queueing of hdev->{cmd,ncmd}_timer works incorrectly used system_wq instead of the device-specific hdev->workqueue. When the system workqueue is drained during destruction, this can cause attempts to schedule work into a draining queue, violating workqueue draining rules introduced in commit c8efcc2589464ac7. The earlier fix (commit 877afadad2dce8aa) was incomplete [1].

The attack surface is local, requiring access to a Bluetooth device on the system. Exploitation would involve triggering a Bluetooth device removal or error path that leads to the problematic work queue scheduling. No authentication is needed beyond the ability to interact with Bluetooth subsystem (e.g., through hci_sock or sysfs). The bug is reachable when the Bluetooth device is being torn down and timers fire.

An attacker who can cause a Bluetooth device to be unregistered or experience an error could force the system to attempt queuing work into a draining workqueue. This may lead to a kernel warning, denial of service (system hang or crash), or potentially more severe consequences depending on the workqueue state [1]. The impact is primarily availability, though the exact worst-case is undefined in the source.

The fix, included in Linux kernel stable updates (as of commit deee93d13d3851032055036ecd83261), changes the queueing to use hdev->workqueue and adds RCU read lock protection to avoid races with cancel_delayed_work(). Users should apply kernel patches from their distribution [1].