Executive brief
A vulnerability in the Linux kernel's Bluetooth component could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue stems from how the system manages Bluetooth connections, specifically when registering or unregistering users. This could lead to data corruption or a complete loss of system availability for devices with Bluetooth enabled.
Technical details
A use-after-free (UAF) vulnerability exists in the Bluetooth L2CAP implementation within the Linux kernel due to inconsistent locking. Specifically, l2cap_register_user() and l2cap_unregister_user() utilized hci_dev_lock() while l2cap_conn_del() utilized conn->lock to protect the same conn->users list. This discrepancy creates a race condition where concurrent access to conn->users and conn->hchan can occur during connection deletion. An attacker within Bluetooth range could potentially exploit this race to trigger a use-after-free or list corruption. The fix involves synchronizing these functions to use the consistent conn->lock mutex.
Affected products
- Linux Linux Kernel 6.13.8 to 6.14, 6.19 to 6.19.10, 6.12.20 to 6.12.78, 6.14.1 to 6.18.20, 6.6.84 to 6.6.130
Timeline
- 2026-04-03: disclosed: Initial publication of the CVE
- 2026-03-12: patched: Fix committed to the Linux kernel tree
References
- https://git.kernel.org/stable/c/11a87dd5df428a4b79a84d2790cac7f3c73f1f0d
- https://git.kernel.org/stable/c/71030f3b3015a412133a805ff47970cdcf30c2b8
- https://git.kernel.org/stable/c/752a6c9596dd25efd6978a73ff21f3b592668f4a
- https://git.kernel.org/stable/c/c22a5e659959eb77c2fbb58a5adfaf3c3dab7abf
- https://git.kernel.org/stable/c/da3000cbe4851458a22be38bb18c0689c39fdd5f