Executive brief
A vulnerability exists in the Linux kernel's Bluetooth subsystem that could allow an attacker to crash the system or potentially execute unauthorized actions. The issue occurs when the system processes incoming Bluetooth data packets while simultaneously disconnecting a device, leading to a memory error known as a 'use-after-free.' This could impact the stability of any device using Bluetooth, such as laptops or embedded systems, and potentially lead to a full system compromise by an attacker within Bluetooth range.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel Bluetooth subsystem (hci_core.c). The root cause is an improper locking pattern (lock/lookup/unlock/use) in the packet RX path that fails to ensure the 'hci_conn' object is not concurrently modified or deleted by other tasks, such as 'hci_disconnect_all_sync'. An attacker within Bluetooth range (adjacent network) can trigger this race condition during the reception of ACL, SCO, or ISO data packets. This can lead to a kernel crash or memory corruption. The fix involves moving the 'hci_conn' lookup into the protocol receive handlers within a single critical section to ensure object persistence during use. Patch commits include 79a2d4678ba9 and ec74cdf77310.
Affected products
- Linux Linux Kernel 6.1.149 to 6.2, 6.4.16 to 6.5, 6.5.3 to 6.6, 6.6 and later versions prior to fix
Timeline
- 2025-11-15: patched: Initial fix authored by Pauli Virtanen
- 2025-12-16: advisory: CVE-2025-68304 published