CVE-2022-49200 is a vulnerability identified in the Linux kernel's Bluetooth subsystem, specifically within the btmtksdio driver, which handles MediaTek SDIO Bluetooth devices. The flaw arises due to a race condition in the initialization sequence of the Bluetooth device. During device initialization, the function hci_register_dev schedules a high-priority workqueue task (hdev->power_on) to power on the device. However, this power-on sequence can execute before the driver properly sets the device-specific data pointer via sdio_set_drvdata in the btmtksdio_probe function. As a result, the interrupt handler btmtksdio_interrupt may be invoked while the driver data pointer is still uninitialized. When btmtksdio_interrupt accesses this uninitialized pointer, it causes a kernel oops (a kernel crash or panic), leading to a denial of service (DoS) condition. The kernel oops stack trace shows the sequence of function calls leading to the fault, confirming the timing issue between power-on and driver data setup. This vulnerability is a logic flaw in the driver initialization order rather than a memory corruption or privilege escalation bug. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The issue affects Linux kernel versions containing the vulnerable btmtksdio driver code prior to the fix. The root cause is the asynchronous execution of the power-on workqueue before the driver data pointer is set, leading to unsafe access in the interrupt handler.

For European organizations, the primary impact of CVE-2022-49200 is potential system instability and denial of service on Linux systems using MediaTek SDIO Bluetooth devices. This could affect a wide range of devices including laptops, embedded systems, IoT devices, and industrial equipment running vulnerable Linux kernels with the btmtksdio driver. The kernel oops can cause system crashes or reboots, disrupting business operations, especially in environments relying on Bluetooth connectivity for peripherals or communications. While this vulnerability does not directly lead to privilege escalation or data leakage, repeated crashes could degrade service availability and increase maintenance overhead. Organizations using Linux-based infrastructure in sectors such as manufacturing, healthcare, or telecommunications where Bluetooth devices are common may face operational risks. Additionally, the vulnerability could be leveraged by attackers to cause targeted denial of service in critical systems if they can trigger Bluetooth interrupts. However, exploitation complexity is moderate since it requires triggering the interrupt during a narrow initialization window. Overall, the impact is primarily availability-related, with potential cascading effects on business continuity and device reliability.

To mitigate CVE-2022-49200, organizations should apply the official Linux kernel patches that reorder the initialization sequence to ensure sdio_set_drvdata is called before the power-on workqueue is scheduled. This fix prevents the interrupt handler from accessing uninitialized pointers. Until patches are applied, practical mitigations include disabling Bluetooth functionality on affected devices if not required, thereby eliminating the attack surface. For embedded or IoT devices, firmware updates incorporating the patched kernel should be prioritized. System administrators should monitor kernel logs for btmtksdio_interrupt oops messages as indicators of attempted exploitation or instability. Additionally, implementing robust system monitoring and automated reboot mechanisms can reduce downtime caused by unexpected kernel crashes. Organizations should also review their asset inventory to identify devices using MediaTek SDIO Bluetooth hardware and prioritize patching accordingly. Finally, coordinating with Linux distribution vendors to obtain timely security updates and testing patches in staging environments before production deployment will ensure minimal disruption.