Executive brief
A vulnerability in the Linux kernel's Bluetooth USB driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when a Bluetooth USB device is disconnected, leading to a memory error where the system attempts to access data that has already been deleted. This could impact system stability and the security of data handled by the Bluetooth subsystem.
Technical details
A use-after-free (UAF) vulnerability exists in the btusb_disconnect() function within drivers/bluetooth/btusb.c of the Linux kernel. The root cause is an incorrect cleanup order where usb_driver_release_interface() is called, freeing the btusb data structure, while subsequent code in the same function still attempts to access members of that structure (such as oob_wake_irq and reset_gpio). A local attacker with the ability to trigger device disconnection could exploit this memory corruption to cause a kernel panic or achieve arbitrary code execution. The fix reorders the function to ensure all data accesses occur before the interface is released and the memory is freed.
Affected products
- Linux Linux Kernel 4.11 to 6.12.y
Timeline
- 2025-11-05: other: Vulnerability fixed in upstream commits
- 2025-12-06: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1c28c1e1522c773a94e26950ffb145e88cd9834b
- https://git.kernel.org/stable/c/23d22f2f71768034d6ef86168213843fc49bf550
- https://git.kernel.org/stable/c/297dbf87989e09af98f81f2bcb938041785557e8
- https://git.kernel.org/stable/c/5dc00065a0496c36694afe11e52a5bc64524a9b8
- https://git.kernel.org/stable/c/7a6d1e740220ff9dfcb6a8c994d6ba49e76db198
- https://git.kernel.org/stable/c/95b9b98c93b1c0916a3d4cf4540b7f5d69145a0d
- https://git.kernel.org/stable/c/a2610ecd9fd5708be8997ca8f033e4200c0bb6af