https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:32:00 +0000 https://vulnerability.circl.lu/vuln/cve-2022-49200 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt</p> <p>Fix the following kernel oops in btmtksdio_interrrupt</p> <p>[ 14.339134] btmtksdio_interrupt+0x28/0x54 [ 14.339139] process_sdio_pending_irqs+0x68/0x1a0 [ 14.339144] sdio_irq_work+0x40/0x70 [ 14.339154] process_one_work+0x184/0x39c [ 14.339160] worker_thread+0x228/0x3e8 [ 14.339168] kthread+0x148/0x3ac [ 14.339176] ret_from_fork+0x10/0x30</p> <p>That happened because hdev-&gt;power_on is already called before sdio_set_drvdata which btmtksdio_interrupt handler relies on is not properly set up.</p> <p>The details are shown as the below: hci_register_dev would run queue_work(hdev-&gt;req_workqueue, &amp;hdev-&gt;power_on) as WQ_HIGHPRI workqueue_struct to complete the power-on sequeunce and thus hci_power_on may run before sdio_set_drvdata is done in btmtksdio_probe.</p> <p>The hci_dev_do_open in hci_power_on would initialize the device and enable the interrupt and thus it is possible that btmtksdio_interrupt is being called right before sdio_set_drvdata is filled out.</p> <p>When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled , the kernel oops is going to happen because btmtksdio_interrupt access an uninitialized pointer.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt</p> <p>Fix the following kernel oops in btmtksdio_interrrupt</p> <p>[ 14.339134] btmtksdio_interrupt+0x28/0x54 [ 14.339139] process_sdio_pending_irqs+0x68/0x1a0 [ 14.339144] sdio_irq_work+0x40/0x70 [ 14.339154] process_one_work+0x184/0x39c [ 14.339160] worker_thread+0x228/0x3e8 [ 14.339168] kthread+0x148/0x3ac [ 14.339176] ret_from_fork+0x10/0x30</p> <p>That happened because hdev-&gt;power_on is already called before sdio_set_drvdata which btmtksdio_interrupt handler relies on is not properly set up.</p> <p>The details are shown as the below: hci_register_dev would run queue_work(hdev-&gt;req_workqueue, &amp;hdev-&gt;power_on) as WQ_HIGHPRI workqueue_struct to complete the power-on sequeunce and thus hci_power_on may run before sdio_set_drvdata is done in btmtksdio_probe.</p> <p>The hci_dev_do_open in hci_power_on would initialize the device and enable the interrupt and thus it is possible that btmtksdio_interrupt is being called right before sdio_set_drvdata is filled out.</p> <p>When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled , the kernel oops is going to happen because btmtksdio_interrupt access an uninitialized pointer.</p> https://vulnerability.circl.lu/vuln/cve-2022-49200