Executive brief
A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem. This flaw could allow an attacker within Bluetooth range to cause a system crash or potentially execute unauthorized code by exploiting how the system handles wireless connection data. This impacts the overall stability and security of devices running affected versions of Linux.
Technical details
A use-after-free (UAF) vulnerability exists in the Bluetooth HCI event handling logic, specifically within the hci_conn_tx_dequeue function. The root cause is a race condition where the hdev structure is not properly locked while processing HCI_EV_NUM_COMP_PKTS events. An attacker within Bluetooth range can exploit this lack of synchronization to trigger a slab-use-after-free when a connection is cleaned up or aborted while packet completion events are still being processed. This has been resolved by implementing proper locking using hci_dev_lock and hci_dev_unlock in the hci_num_comp_pkts_evt function.
Affected products
- Linux Linux Kernel 6.15 to 6.16.10
Timeline
- 2025-08-25: patched: Initial patch authored
- 2025-10-15: advisory: CVE published