Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system attempts to access Bluetooth connection data that has already been deleted from memory. This typically requires the attacker to be within Bluetooth range of the target device.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/hci_sync.c within the le_read_features_complete function. The root cause is a race condition where an hci_conn object is freed after hci_le_read_remote_features_sync completes but before le_read_features_complete is called. Because the connection deletion occurs at a point where hci_cmd_sync_dequeue cannot intercept the pending command, the kernel attempts to access the freed memory, resulting in a KASAN-detected slab-use-after-free. This can be triggered by an adjacent attacker via Bluetooth and has been resolved in the stable kernel tree.
Affected products
- Linux Linux Kernel All versions prior to the fix in hci_sync.c
Timeline
- 2026-03-25: other: Patch authored
- 2026-05-08: disclosed: CVE published