CVE-2022-49555

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_qca: Use del_timer_sync() before freeing

While looking at a crash report on a timer list being corrupted, which usually happens when a timer is freed while still active. This is commonly triggered by code calling del_timer() instead of del_timer_sync() just before freeing.

One possible culprit is the hci_qca driver, which does exactly that.

Eric mentioned that wake_retrans_timer could be rearmed via the work queue, so also move the destruction of the work queue before del_timer_sync().

This vulnerability presents minimal risk to Red Hat Enterprise Linux environments, as supported enterprise kernel builds do not ship or enable the affected driver code. Exploiting the flaw requires local system access alongside specialized Qualcomm Atheros Bluetooth hardware interfaces. Consequently, standard Red Hat enterprise installations are not impacted by this issue.