PT-2025-26092 · Linux+3 · Linux Kernel+3

Published 2022-06-03 · Updated 2026-05-26 · CVE-2022-50166

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel's Bluetooth functionality has been identified. When the HCI work queue is drained, only queue chained work is allowed, but another delayed work can still queue commands to this drained workqueue, resulting in an error. This issue can cause a deadlock and has been observed with an error report indicating a command timeout. The vulnerability affects the HCI command, event, and data packet processing workqueue.

Recommendations To fix this issue, a new HCI DRAIN WQ flag can be added to prevent queuing the timeout workqueue while the command workqueue is draining. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

AZL-70358

BDU:2026-05785

CVE-2022-50166

RHSA-2023:2458

RHSA-2023_2458

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

Affected Products

Debian

Linux Kernel

Red Hat

Suse

References · 584

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50166.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50166 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-50166 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05785 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:02264-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-50166 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://git.kernel.org/stable/c/3b382555706558f5c0587862b6dc03e96a252bba · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50166 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50166 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50166 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50166 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50166 · Vendor Advisory
• https://git.kernel.org/stable/c/4bf367fa1fefabdf14938d0ac9ed60020389112e · Patch
• https://osv.dev/vulnerability/AZL-70358 · Vendor Advisory