{"id":"CVE-2022-50339","state":"PUBLISHED","title":"Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()\n\nsyzbot is again reporting attempt to cancel uninitialized work\nat mgmt_index_removed() [1], for setting of HCI_MGMT flag from\nmgmt_init_hdev() from hci_mgmt_cmd() from hci_sock_sendmsg() can\nrace with testing of HCI_MGMT flag from mgmt_index_removed() from\nhci_sock_bind() due to lack of serialization via hci_dev_lock().\n\nSince mgmt_init_hdev() is called with mgmt_chan_list_lock held, we can\nsafely split hci_dev_test_and_set_flag() into hci_dev_test_flag() and\nhci_dev_set_flag(). Thus, in order to close this race, set HCI_MGMT flag\nafter INIT_DELAYED_WORK() completed.\n\nThis is a local fix based on mgmt_chan_list_lock. Lack of serialization\nvia hci_dev_lock() might be causing different race conditions somewhere\nelse. But a global fix based on hci_dev_lock() should deserve a future\npatch.","publishedAt":"2025-09-16T16:11:19.138Z","updatedAt":"2026-08-05T08:58:17.461Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3f2893d3c142986aa935821460cb3adb77044722","status":"affected","lessThan":"e53c6180db8dd09de94e0a3bdf4fef6f5f9dd6e6","versionType":"git"},{"version":"3f2893d3c142986aa935821460cb3adb77044722","status":"affected","lessThan":"f74ca25d6d6629ffd4fd80a1a73037253b57d06b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.0.3","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"]}],"references":["https://git.kernel.org/stable/c/e53c6180db8dd09de94e0a3bdf4fef6f5f9dd6e6","https://git.kernel.org/stable/c/f74ca25d6d6629ffd4fd80a1a73037253b57d06b"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50339.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50339","state":"PUBLISHED","datePublished":"2025-09-16T16:11:19.138Z","dateUpdated":"2026-08-05T08:58:17.461Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-16T16:03:27.881Z"},"containers":{"cna":{"title":"Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()\n\nsyzbot is again reporting attempt to cancel uninitialized work\nat mgmt_index_removed() [1], for setting of HCI_MGMT flag from\nmgmt_init_hdev() from hci_mgmt_cmd() from hci_sock_sendmsg() can\nrace with testing of HCI_MGMT flag from mgmt_index_removed() from\nhci_sock_bind() due to lack of serialization via hci_dev_lock().\n\nSince mgmt_init_hdev() is called with mgmt_chan_list_lock held, we can\nsafely split hci_dev_test_and_set_flag() into hci_dev_test_flag() and\nhci_dev_set_flag(). Thus, in order to close this race, set HCI_MGMT flag\nafter INIT_DELAYED_WORK() completed.\n\nThis is a local fix based on mgmt_chan_list_lock. Lack of serialization\nvia hci_dev_lock() might be causing different race conditions somewhere\nelse. But a global fix based on hci_dev_lock() should deserve a future\npatch."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3f2893d3c142986aa935821460cb3adb77044722","status":"affected","lessThan":"e53c6180db8dd09de94e0a3bdf4fef6f5f9dd6e6","versionType":"git"},{"version":"3f2893d3c142986aa935821460cb3adb77044722","status":"affected","lessThan":"f74ca25d6d6629ffd4fd80a1a73037253b57d06b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.0.3","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e53c6180db8dd09de94e0a3bdf4fef6f5f9dd6e6"},{"url":"https://git.kernel.org/stable/c/f74ca25d6d6629ffd4fd80a1a73037253b57d06b"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable paths are local AF_BLUETOOTH HCI socket operations (hci_sock_sendmsg → hci_mgmt_cmd → mgmt_init_hdev racing hci_sock_bind → mgmt_index_removed), not Bluetooth radio frame processing, so this is Local rather than Adjacent.\nAC:L - An attacker who can open an HCI CONTROL socket and an HCI USER socket controls both sides of the race (sendmsg triggering mgmt_init_hdev concurrent with bind triggering mgmt_index_removed), so success does not depend on conditions outside their influence.\nPR:L - HCI_CHANNEL_CONTROL bind needs no capability, and untrusted MGMT_OP_READ_INFO reaches mgmt_init_hdev; HCI_CHANNEL_USER needs CAP_NET_ADMIN, which is commonly held by Bluetooth/network management contexts and, when uncertain, is scored Low rather than High.\nUI:N - The attacker issues the concurrent bind/sendmsg syscalls themselves; no separate victim action such as mounting a volume or confirming a prompt is required.\nS:U - Impact remains inside the host kernel Bluetooth mgmt/workqueue authority as a same-host memory-safety issue, with no VM escape, IOMMU bypass, or other security-boundary crossing.\nC:H - Racing INIT_DELAYED_WORK with cancel_delayed_work_sync on the same delayed_work/timer state can corrupt workqueue and timer-list structures, which is kernel memory corruption leverageable for arbitrary read primitives under the higher-severity rule.\nI:H - The same concurrent init-versus-cancel corruption of work/timer objects can yield heap/list write primitives suitable for control-flow hijacking beyond a pure crash.\nA:H - cancel_delayed_work_sync on uninitialized or partially initialized work triggers kernel WARNINGs (ODEBUG) and can oops/panic via corrupted timer/workqueue state, which is Availability High."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:58:17.461Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.0.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-50339","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-14T18:19:15.738388Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","type":"CWE","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-14T18:22:57.449Z"}}]}}}