Executive brief
The Linux kernel's Bluetooth socket implementation contains a race condition between socket binding and write operations that can lead to use-after-free memory errors. An attacker could exploit this to cause a kernel crash or potentially execute arbitrary code on systems running vulnerable kernel versions.
Technical details
The vulnerability is a use-after-free (UAF) race condition in the Bluetooth hci_sock handler (net/bluetooth/hci_sock.c). The race occurs between the socket bind operation (hci_sock_bind) and socket write iterator (sock_write_iter), where bind can free a pending management command via mgmt_pending_free before write iter has finished sending it. The vulnerable component mgmt_pending_remove in mgmt_util.c attempts to access already-freed memory. The fix synchronizes these operations using hci_dev_lock to prevent concurrent access to the same command structure. This is a kernel-level vulnerability that requires either local code execution capability or privileged access to trigger.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2025-12-16: disclosed