Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem specifically affecting Intel-based hardware. The flaw occurs when the system attempts to recover from a hardware error while simultaneously closing the Bluetooth device, leading to a system crash or potential instability. This could allow a local user with basic access to disrupt system operations or potentially gain unauthorized control over the system.
Technical details
A use-after-free (UAF) vulnerability exists in the btintel_hw_error() function within the Linux kernel's Bluetooth driver. The root cause is a lack of proper synchronization; btintel_hw_error() invokes __hci_cmd_sync() without holding the hci_req_sync_lock(). This creates a race condition with hci_dev_do_close(), which calls btintel_shutdown_combined() under the same lock. When these paths execute concurrently, the device closure path may free the response socket buffer (skb) while the error handling path is still accessing it, leading to a slab-use-after-free. An attacker with local access could exploit this race to cause a kernel panic or potentially execute arbitrary code. Patches have been released across various stable kernel branches to wrap the recovery sequence in the appropriate sync locks.
Affected products
- Linux Linux Kernel 4.3 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11
Timeline
- 2026-03-18: other: Patch authored
- 2026-04-22: disclosed: Initial disclosure and CVE assignment
- 2026-04-22: advisory
- 2026-06-01: patched: Final stable branch patches applied
References
- https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d
- https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010
- https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3
- https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae
- https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5
- https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e