LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49200: Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt Fix the following kernel oops in btmtksdio_interrrupt [ 14.339134] btmtksdio_interrupt+0x28/0x54 [ 14.339139] process_sdio_pending_irqs+0x68/0x1a0 [ 14.339144] sdio_irq_work+0x40/0x70 [ 14.339154] process_one_work+0x184/0x39c [ 14.339160] worker_thread+0x228/0x3e8 [ 14.339168] kthread+0x148/0x3ac [ 14.339176] ret_from_fork+0x10/0x30 That happened because hdev->power_on is already called before sdio_set_drvdata which btmtksdio_interrupt handler relies on is not properly set up. The details are shown as the below: hci_register_dev would run queue_work(hdev->req_workqueue, &hdev->power_on) as WQ_HIGHPRI workqueue_struct to complete the power-on sequeunce and thus hci_power_on may run before sdio_set_drvdata is done in btmtksdio_probe. The hci_dev_do_open in hci_power_on would initialize the device and enable the interrupt and thus it is possible that btmtksdio_interrupt is being called right before sdio_set_drvdata is filled out. When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled , the kernel oops is going to happen because btmtksdio_interrupt access an uninitialized pointer.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw in the MediaTek SDIO Bluetooth driver. During device startup, an interrupt can run before driver data is initialized, causing a kernel oops. Business impact is mainly availability risk on systems using this driver.

Executive priority

Treat as a targeted kernel availability issue. Prioritize embedded, appliance, laptop, or IoT fleets with MediaTek SDIO Bluetooth. Broad enterprise urgency is lower without evidence of exploitation or remote reachability.

Technical view

The btmtksdio_interrupt handler relies on SDIO driver data. hci_register_dev can queue high-priority power-on work before sdio_set_drvdata completes, enabling interrupts and allowing the handler to dereference uninitialized state, resulting in a kernel oops.

Likely exposure

Exposure appears limited to Linux systems using the btmtksdio MediaTek SDIO Bluetooth driver on affected kernel versions or downstream kernels lacking the referenced stable fixes.

Exploitation context

The source bundle does not report active exploitation, KEV listing, public exploit code, CVSS, or CWE classification. Evidence supports a race-triggered kernel crash condition, not remote code execution.

Researcher notes

Key condition is a probe-time race: hdev power_on can execute before sdio_set_drvdata, while interrupt handling assumes driver data exists. Analysis should focus on affected backports and actual hardware/driver presence.

Mitigation direction

  • Apply a Linux vendor kernel update containing the referenced btmtksdio stable fixes.
  • Confirm distribution backports rather than relying only on upstream version numbers.
  • Prioritize systems using MediaTek SDIO Bluetooth hardware or embedded Linux images.
  • Check vendor guidance if no fixed package is available.

Validation and detection

  • Inventory systems for Linux kernels using the btmtksdio driver.
  • Compare installed kernel packages against vendor advisories and referenced stable commits.
  • Review kernel logs for btmtksdio_interrupt oops during Bluetooth device initialization.
  • Verify patched builds no longer match affected downstream kernel baselines.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49200 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9aebfd4a2200ab8075e44379c758bccefdc589bb, 9aebfd4a2200ab8075e44379c758bccefdc589bb, 9aebfd4a2200ab8075e44379c758bccefdc589bb, 9aebfd4a2200ab8075e44379c758bccefdc589bb, 9aebfd4a2200ab8075e44379c758bccefdc589bb, 9aebfd4a2200ab8075e44379c758bccefdc589bbunaffected
LinuxLinux5.2, 0, 5.4.189, 5.10.110, 5.15.33, 5.16.19, 5.17.2, 5.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.