CVE-2022-49136

A vulnerability was found in the Linux kernel's Bluetooth subsystem in the hci_cmd_sync_queue() function. There was a missing check for whether the HCI_UNREGISTER flag had been set, meaning that commands were still sent even as the Bluetooth device was being unregistered. This issue could lead to a use-after-free scenario where the command is executed after the device structure is freed, potentially leading to a crash, arbitrary code execution, and system instability.

This vulnerability is evaluated as Moderate severity because successful exploitation requires local system access and precise timing during the unregistration of a Bluetooth interface. Typical Red Hat Enterprise Linux server installations do not utilize Bluetooth hardware or run the Bluetooth stack, significantly limiting exposure in standard enterprise environments. Even where Bluetooth devices are enabled, triggering this condition demands specific timing between command queuing and device teardown, reducing the feasibility of reliable exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.