CVE-2022-50374 – A race condition vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2022-50374?

CVE-2022-50374 has a CVSS score of 5.5 (MEDIUM). A race condition vulnerability in the Linux kernel's Bluetooth subsystem where failure to initialize synchronization primitives can lead to NULL pointer dereference. This affects Linux systems with Bluetooth hardware support, potentially causing kernel crashes or denial of service.

📋 TL;DR

A race condition vulnerability in the Linux kernel's Bluetooth subsystem where failure to initialize synchronization primitives can lead to NULL pointer dereference. This affects Linux systems with Bluetooth hardware support, potentially causing kernel crashes or denial of service.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE; check kernel commit history for vulnerable code

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Bluetooth hardware and kernel Bluetooth support enabled

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, requiring physical or remote reboot.

🟠

Likely Case

Bluetooth subsystem crash causing loss of Bluetooth functionality until system restart.

🟢

If Mitigated

No impact if proper kernel patches are applied or Bluetooth is disabled.

🌐 Internet-Facing: LOW - Requires local access or Bluetooth proximity; not directly exploitable over internet.

🏢 Internal Only: MEDIUM - Local attackers or malicious processes could trigger the vulnerability to cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access or ability to trigger Bluetooth operations; discovered via syzbot fuzzing

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel commits: 3124d320c22f3f4388d9ac5c8f37eaad0fd6b1, 75b2c71ea581c7bb1303860d89366a42ad0506d2, 98ce10f3f345e61fc6c83bff9cd11cda252b05ac, b8917dce2134739b39bc0a5648b18427f2cad569, d7cc0d51ffcbfd1caaa809fcf9cff05c46d0fb4d

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing fixes. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable Bluetooth

Linux

Disable Bluetooth kernel modules to prevent vulnerability trigger

sudo systemctl stop bluetooth
sudo modprobe -r btusb
sudo modprobe -r bluetooth

🧯 If You Can't Patch

Disable Bluetooth hardware in BIOS/UEFI if available
Implement strict access controls to prevent local users from triggering Bluetooth operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution security advisories; examine if Bluetooth modules are loaded

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits; test Bluetooth functionality after patch

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Bluetooth subsystem crashes in dmesg
NULL pointer dereference errors

Network Indicators:

Sudden loss of Bluetooth connectivity

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "hci_uart" OR "Bluetooth crash")

📊 Metadata

CVE ID: CVE-2022-50374

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-908

EPSS Score: 0.01% exploit probability (1.1th percentile)

Published: September 17, 2025

Last Updated: January 14, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-50374, you might also want to check these: