Executive brief
A vulnerability in the Linux kernel's Bluetooth USB driver could allow a local user to cause a system crash or potentially execute unauthorized code. The issue stems from how the system manages memory when Bluetooth devices are disconnected, leading to a situation where the system tries to use memory that has already been cleared. This could impact the overall stability and security of systems using Bluetooth USB adapters.
Technical details
A use-after-free vulnerability exists in drivers/bluetooth/btusb.c due to the use of devm_kzalloc() in btusb_probe(). The devres-managed allocation ties the lifetime of the 'btusb' data structure to a single USB interface. However, the driver binds to multiple interfaces (INTF, ISOC, and DIAG). When usb_driver_release_interface() is called during disconnection for one interface, devres automatically frees the shared data structure while other interfaces may still be active and attempting to access it. The fix involves reverting to manual memory management using kzalloc() and explicit kfree() calls to ensure the data persists until all interfaces are released.
Affected products
- Linux Linux Kernel 3.7 to 6.18.4
Timeline
- 2025-12-19: patched: Initial fix commit in Linux kernel main tree
- 2026-01-13: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339
- https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880
- https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b
- https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc
- https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003
- https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1