Executive brief
A use-after-free vulnerability exists in the Linux kernel's Bluetooth subsystem that can be triggered during connection cleanup operations. An attacker with local access to a system with Bluetooth hardware could exploit this flaw to cause a kernel crash or potentially gain elevated privileges through memory corruption.
Technical details
The vulnerability is a use-after-free (UAF) in the hci_disconnect_all_sync function within the Bluetooth HCI sync layer (net/bluetooth/hci_sync.c). The root cause is a race condition where a connection object may be freed by concurrent processing of a controller event while the cleanup code still holds a reference to it. The fix involves iterating over the connection list backwards to ensure dependent links are cleaned up before their parents, and removing reliance on a cursor in favor of always using the last element, since hci_abort_conn_sync is guaranteed to call hci_conn_del. The vulnerability can be triggered from the Bluetooth connection establishment path (iso_sock_connect) and is reachable by local users with Bluetooth device access.
Affected products
- Linux Linux kernel 6.5.0-rc1 and likely other versions
Timeline
- 2025-12-08: disclosed: CVE-2023-53762 published