Executive brief
A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem. This flaw could allow an attacker within Bluetooth range to cause a system crash or potentially execute unauthorized code by exploiting how the system handles disconnected Bluetooth input devices. This impacts the stability and security of any Linux-based system using Bluetooth HID (Human Interface Device) profiles.
Technical details
A use-after-free (UAF) vulnerability exists in the Bluetooth Human Interface Device Protocol (HIDP) implementation within the Linux kernel. The issue is caused by a failure to properly drop the l2cap_conn reference when the user->remove callback is invoked, leading to a reference counting error. An attacker within physical proximity (Bluetooth range) could potentially exploit this during device disconnection to trigger a kernel panic or achieve remote code execution. The vulnerability has been addressed in multiple stable kernel branches including 5.15.y, 6.1.y, 6.6.y, 6.12.y, and 6.18.y.
Affected products
- Linux Linux Kernel 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-05: patched: Initial patch authored by Luiz Augusto von Dentz
- 2026-04-03: advisory: CVE-2026-23462 published
References
- https://git.kernel.org/stable/c/18b1263ece6431bd78fa6b61faaef5281203741c
- https://git.kernel.org/stable/c/21a47a119f33df9bb157326846390d7e8e1b45ba
- https://git.kernel.org/stable/c/45ebe5b900200ac3e01f3470506a44a447825721
- https://git.kernel.org/stable/c/4d37fa7582aa960ba23e10a7a2596a29f37ad281
- https://git.kernel.org/stable/c/7c805b7d1e580eececcc92470292e3dbc42bc3f5
- https://git.kernel.org/stable/c/d955ccbf91ab74d76fe9e4eab2846a7d8a173075
- https://git.kernel.org/stable/c/dbf666e4fc9bdd975a61bf682b3f75cb0145eedd