GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50166 (GCVE-0-2022-50166)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:03 – Updated: 2026-05-11 19:14
VLAI
Title
Bluetooth: When HCI work queue is drained, only queue chained work
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: When HCI work queue is drained, only queue chained work The HCI command, event, and data packet processing workqueue is drained to avoid deadlock in commit 76727c02c1e1 ("Bluetooth: Call drain_workqueue() before resetting state"). There is another delayed work, which will queue command to this drained workqueue. Which results in the following error report: Bluetooth: hci2: command 0x040f tx timeout WARNING: CPU: 1 PID: 18374 at kernel/workqueue.c:1438 __queue_work+0xdad/0x1140 Workqueue: events hci_cmd_timeout RIP: 0010:__queue_work+0xdad/0x1140 RSP: 0000:ffffc90002cffc60 EFLAGS: 00010093 RAX: 0000000000000000 RBX: ffff8880b9d3ec00 RCX: 0000000000000000 RDX: ffff888024ba0000 RSI: ffffffff814e048d RDI: ffff8880b9d3ec08 RBP: 0000000000000008 R08: 0000000000000000 R09: 00000000b9d39700 R10: ffffffff814f73c6 R11: 0000000000000000 R12: ffff88807cce4c60 R13: 0000000000000000 R14: ffff8880796d8800 R15: ffff8880796d8800 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c0174b4000 CR3: 000000007cae9000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? queue_work_on+0xcb/0x110 ? lockdep_hardirqs_off+0x90/0xd0 queue_work_on+0xee/0x110 process_one_work+0x996/0x1610 ? pwq_dec_nr_in_flight+0x2a0/0x2a0 ? rwlock_bug.part.0+0x90/0x90 ? _raw_spin_lock_irq+0x41/0x50 worker_thread+0x665/0x1080 ? process_one_work+0x1610/0x1610 kthread+0x2e9/0x3a0 ? kthread_complete_and_exit+0x40/0x40 ret_from_fork+0x1f/0x30 </TASK> To fix this, we can add a new HCI_DRAIN_WQ flag, and don't queue the timeout workqueue while command workqueue is draining.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 76727c02c1e14a2b561b806fa1d08acc1619ad27 , < 4bf367fa1fefabdf14938d0ac9ed60020389112e (git)
Affected: 76727c02c1e14a2b561b806fa1d08acc1619ad27 , < 3b382555706558f5c0587862b6dc03e96a252bba (git)
Affected: 76727c02c1e14a2b561b806fa1d08acc1619ad27 , < 877afadad2dce8aae1f2aad8ce47e072d4f6165e (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 5.18.18 , ≤ 5.18.* (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/hci.h",
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4bf367fa1fefabdf14938d0ac9ed60020389112e",
              "status": "affected",
              "version": "76727c02c1e14a2b561b806fa1d08acc1619ad27",
              "versionType": "git"
            },
            {
              "lessThan": "3b382555706558f5c0587862b6dc03e96a252bba",
              "status": "affected",
              "version": "76727c02c1e14a2b561b806fa1d08acc1619ad27",
              "versionType": "git"
            },
            {
              "lessThan": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
              "status": "affected",
              "version": "76727c02c1e14a2b561b806fa1d08acc1619ad27",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/hci.h",
            "net/bluetooth/hci_core.c",
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: When HCI work queue is drained, only queue chained work\n\nThe HCI command, event, and data packet processing workqueue is drained\nto avoid deadlock in commit\n76727c02c1e1 (\"Bluetooth: Call drain_workqueue() before resetting state\").\n\nThere is another delayed work, which will queue command to this drained\nworkqueue. Which results in the following error report:\n\nBluetooth: hci2: command 0x040f tx timeout\nWARNING: CPU: 1 PID: 18374 at kernel/workqueue.c:1438 __queue_work+0xdad/0x1140\nWorkqueue: events hci_cmd_timeout\nRIP: 0010:__queue_work+0xdad/0x1140\nRSP: 0000:ffffc90002cffc60 EFLAGS: 00010093\nRAX: 0000000000000000 RBX: ffff8880b9d3ec00 RCX: 0000000000000000\nRDX: ffff888024ba0000 RSI: ffffffff814e048d RDI: ffff8880b9d3ec08\nRBP: 0000000000000008 R08: 0000000000000000 R09: 00000000b9d39700\nR10: ffffffff814f73c6 R11: 0000000000000000 R12: ffff88807cce4c60\nR13: 0000000000000000 R14: ffff8880796d8800 R15: ffff8880796d8800\nFS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000c0174b4000 CR3: 000000007cae9000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? queue_work_on+0xcb/0x110\n ? lockdep_hardirqs_off+0x90/0xd0\n queue_work_on+0xee/0x110\n process_one_work+0x996/0x1610\n ? pwq_dec_nr_in_flight+0x2a0/0x2a0\n ? rwlock_bug.part.0+0x90/0x90\n ? _raw_spin_lock_irq+0x41/0x50\n worker_thread+0x665/0x1080\n ? process_one_work+0x1610/0x1610\n kthread+0x2e9/0x3a0\n ? kthread_complete_and_exit+0x40/0x40\n ret_from_fork+0x1f/0x30\n \u003c/TASK\u003e\n\nTo fix this, we can add a new HCI_DRAIN_WQ flag, and don\u0027t queue the\ntimeout workqueue while command workqueue is draining."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:14:05.616Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4bf367fa1fefabdf14938d0ac9ed60020389112e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b382555706558f5c0587862b6dc03e96a252bba"
        },
        {
          "url": "https://git.kernel.org/stable/c/877afadad2dce8aae1f2aad8ce47e072d4f6165e"
        }
      ],
      "title": "Bluetooth: When HCI work queue is drained, only queue chained work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50166",
    "datePublished": "2025-06-18T11:03:20.323Z",
    "dateReserved": "2025-06-18T10:57:27.426Z",
    "dateUpdated": "2026-05-11T19:14:05.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50166",
      "date": "2026-09-16",
      "epss": "0.00167",
      "percentile": "0.0637"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-09T01:47:57.000Z",
      "cve": "CVE-2022-50166",
      "id": "msrc_CVE-2022-50166",
      "initial_release_date": "2025-11-19T01:01:33.000Z",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: When HCI work queue is drained, only queue chained work",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2022-50166.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50166\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:46.907\",\"lastModified\":\"2026-06-17T05:22:53.700\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: When HCI work queue is drained, only queue chained work\\n\\nThe HCI command, event, and data packet processing workqueue is drained\\nto avoid deadlock in commit\\n76727c02c1e1 (\\\"Bluetooth: Call drain_workqueue() before resetting state\\\").\\n\\nThere is another delayed work, which will queue command to this drained\\nworkqueue. Which results in the following error report:\\n\\nBluetooth: hci2: command 0x040f tx timeout\\nWARNING: CPU: 1 PID: 18374 at kernel/workqueue.c:1438 __queue_work+0xdad/0x1140\\nWorkqueue: events hci_cmd_timeout\\nRIP: 0010:__queue_work+0xdad/0x1140\\nRSP: 0000:ffffc90002cffc60 EFLAGS: 00010093\\nRAX: 0000000000000000 RBX: ffff8880b9d3ec00 RCX: 0000000000000000\\nRDX: ffff888024ba0000 RSI: ffffffff814e048d RDI: ffff8880b9d3ec08\\nRBP: 0000000000000008 R08: 0000000000000000 R09: 00000000b9d39700\\nR10: ffffffff814f73c6 R11: 0000000000000000 R12: ffff88807cce4c60\\nR13: 0000000000000000 R14: ffff8880796d8800 R15: ffff8880796d8800\\nFS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 000000c0174b4000 CR3: 000000007cae9000 CR4: 00000000003506e0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n ? queue_work_on+0xcb/0x110\\n ? lockdep_hardirqs_off+0x90/0xd0\\n queue_work_on+0xee/0x110\\n process_one_work+0x996/0x1610\\n ? pwq_dec_nr_in_flight+0x2a0/0x2a0\\n ? rwlock_bug.part.0+0x90/0x90\\n ? _raw_spin_lock_irq+0x41/0x50\\n worker_thread+0x665/0x1080\\n ? process_one_work+0x1610/0x1610\\n kthread+0x2e9/0x3a0\\n ? kthread_complete_and_exit+0x40/0x40\\n ret_from_fork+0x1f/0x30\\n \u003c/TASK\u003e\\n\\nTo fix this, we can add a new HCI_DRAIN_WQ flag, and don\u0027t queue the\\ntimeout workqueue while command workqueue is draining.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: Al vaciar la cola de trabajo de HCI, solo se pone en cola el trabajo encadenado. La cola de trabajo de procesamiento de comandos, eventos y paquetes de datos de HCI se vac\u00eda para evitar un bloqueo en el commit 76727c02c1e1 (\\\"Bluetooth: Llamar a drain_workqueue() antes de restablecer el estado\\\"). Existe otro trabajo retrasado que pondr\u00e1 en cola el comando en esta cola de trabajo vaciada. Lo que genera el siguiente informe de error: Bluetooth: hci2: command 0x040f tx timeout ADVERTENCIA: CPU: 1 PID: 18374 en kernel/workqueue.c:1438 __queue_work+0xdad/0x1140 Workqueue: events hci_cmd_timeout RIP: 0010:__queue_work+0xdad/0x1140 RSP: 0000:ffffc90002cffc60 EFLAGS: 00010093 RAX: 0000000000000000 RBX: ffff8880b9d3ec00 RCX: 0000000000000000 RDX: ffff888024ba0000 RSI: ffffffff814e048d RDI: ffff8880b9d3ec08 RBP: 0000000000000008 R08: 0000000000000000 R09: 00000000b9d39700 R10: ffffffff814f73c6 R11: 000000000000000 R12: ffff88807cce4c60 R13: 000000000000000 R14: ffff8880796d8800 R15: ffff8880796d8800 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c0174b4000 CR3: 000000007cae9000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Rastreo de llamadas:  ? queue_work_on+0xcb/0x110 ? lockdep_hardirqs_off+0x90/0xd0 queue_work_on+0xee/0x110 process_one_work+0x996/0x1610 ? pwq_dec_nr_in_flight+0x2a0/0x2a0 ? rwlock_bug.part.0+0x90/0x90 ? _raw_spin_lock_irq+0x41/0x50 worker_thread+0x665/0x1080 ? process_one_work+0x1610/0x1610 kthread+0x2e9/0x3a0 ? kthread_complete_and_exit+0x40/0x40 ret_from_fork+0x1f/0x30  Para solucionar esto, podemos agregar un nuevo indicador HCI_DRAIN_WQ y no poner en cola la cola de trabajo de tiempo de espera mientras se drena la cola de trabajo de comandos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/bluetooth/hci.h\",\"net/bluetooth/hci_core.c\",\"net/bluetooth/hci_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"76727c02c1e14a2b561b806fa1d08acc1619ad27\",\"lessThan\":\"4bf367fa1fefabdf14938d0ac9ed60020389112e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76727c02c1e14a2b561b806fa1d08acc1619ad27\",\"lessThan\":\"3b382555706558f5c0587862b6dc03e96a252bba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"76727c02c1e14a2b561b806fa1d08acc1619ad27\",\"lessThan\":\"877afadad2dce8aae1f2aad8ce47e072d4f6165e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/bluetooth/hci.h\",\"net/bluetooth/hci_core.c\",\"net/bluetooth/hci_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.18\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.2\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.19\",\"versionEndExcluding\":\"5.18.18\",\"matchCriteriaId\":\"0CDE8642-6286-4714-B4AF-43F17DF312ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"5.19.2\",\"matchCriteriaId\":\"A1A2A5A5-4598-4D7E-BA07-4660398D6C8F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3b382555706558f5c0587862b6dc03e96a252bba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4bf367fa1fefabdf14938d0ac9ed60020389112e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/877afadad2dce8aae1f2aad8ce47e072d4f6165e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:40:28+00:00",
      "cve": "CVE-2022-50166",
      "id": "CVE-2022-50166",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "84",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: When HCI work queue is drained, only queue chained work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50166.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:57:43Z",
      "cve": "CVE-2022-50166",
      "id": "CVE-2022-50166",
      "initial_release_date": "2025-06-19T03:40:03Z",
      "product_status:known_affected": "701",
      "product_status:known_not_affected": "183",
      "product_status:recommended": "119",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50166",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50166.json",
      "version": "49"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.