CVE-2022-50339

A race condition exists in the Bluetooth module of the linux kernel such that a Lack of serialization via hci_dev_lock() causes a race condition, resulting in damage to the availability and integrity of the system.

A race condition was found in the Bluetooth management subsystem of the Linux kernel, rated by Red Hat Product Security as having Moderate security impact. Due to a lack of serialization via hci_dev_lock(), the setting of the HCI_MGMT flag in mgmt_init_hdev(), reached when a local user sends a Bluetooth management command through hci_sock_sendmsg(), can race with the testing of the HCI_MGMT flag in mgmt_index_removed(), reached through hci_sock_bind(). A local user able to open and use a Bluetooth management socket could exploit this race to trigger an attempt to cancel uninitialized delayed work, impacting system availability. The Moderate rating reflects the local attack vector, privileges required, and high attack complexity of triggering this narrow race window, which is lower than the Important severity implied by the published CVSS 3.1 scores (7.0 from Red Hat, NIST, and CISA; 7.8 from the upstream CVE record). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS releases tracked for this flaw are not affected because the vulnerable code is not present in the shipped kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.