{"id":"DEBIAN-CVE-2022-49200","details":"In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt  Fix the following kernel oops in btmtksdio_interrrupt  [   14.339134]  btmtksdio_interrupt+0x28/0x54 [   14.339139]  process_sdio_pending_irqs+0x68/0x1a0 [   14.339144]  sdio_irq_work+0x40/0x70 [   14.339154]  process_one_work+0x184/0x39c [   14.339160]  worker_thread+0x228/0x3e8 [   14.339168]  kthread+0x148/0x3ac [   14.339176]  ret_from_fork+0x10/0x30  That happened because hdev-\u003epower_on is already called before sdio_set_drvdata which btmtksdio_interrupt handler relies on is not properly set up.  The details are shown as the below: hci_register_dev would run queue_work(hdev-\u003ereq_workqueue, &hdev-\u003epower_on) as WQ_HIGHPRI workqueue_struct to complete the power-on sequeunce and thus hci_power_on may run before sdio_set_drvdata is done in btmtksdio_probe.  The hci_dev_do_open in hci_power_on would initialize the device and enable the interrupt and thus it is possible that btmtksdio_interrupt is being called right before sdio_set_drvdata is filled out.  When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled , the kernel oops is going to happen because btmtksdio_interrupt access an uninitialized pointer.","modified":"2026-09-01T16:05:30.210872537Z","published":"2025-02-26T07:00:57.067Z","upstream":["CVE-2022-49200"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49200"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49200.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49200.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49200.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}