Executive brief
A synchronization issue was identified in the Linux kernel's Bluetooth subsystem. This flaw could allow a local attacker to cause a system crash or unpredictable behavior by triggering concurrent operations that interfere with how the system tracks Bluetooth command status. This primarily impacts the reliability and availability of devices using Bluetooth on affected Linux systems.
Technical details
A data race exists in the Linux kernel Bluetooth subsystem (hci_sync) due to improper locking around the 'hdev->req_status' variable. While '__hci_cmd_sync_sk()' modifies this status under 'hdev->req_lock', other functions such as 'hci_send_cmd_sync()', 'hci_cmd_sync_complete()', and 'hci_abort_conn()' access it without synchronization across different workqueues. This concurrent access on multi-core systems can lead to compiler-induced optimizations like load fusing or store reordering, resulting in incorrect state transitions or kernel hangs. The fix involves implementing READ_ONCE() and WRITE_ONCE() annotations to ensure atomic visibility of the status variable across different execution contexts.
Affected products
- Linux Linux Kernel 4.19.47 to 4.20, 5.0.20 to 5.1, 5.1.6 to 5.2, 5.2 to 6.12.83, 6.18.24, 6.19.14
Timeline
- 2026-05-06: advisory: Initial disclosure date
- 2026-04-22: patched: Fixes committed to stable branches
References
- https://git.kernel.org/stable/c/40734ce8efc34c4a0d0222855798c0dc14b65f2e
- https://git.kernel.org/stable/c/6e539907c0d11f514c5e0b049b27b04dff48a5b1
- https://git.kernel.org/stable/c/a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27
- https://git.kernel.org/stable/c/b6807cfc195ef99e1ac37b2e1e60df40295daa8c
- https://git.kernel.org/stable/c/e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4