Executive brief
A security vulnerability has been identified in the Linux kernel's Bluetooth subsystem. This flaw could allow a nearby attacker to cause a system crash or potentially execute unauthorized code by exploiting a race condition during the Bluetooth pairing process. The issue specifically affects how the system handles passkey notifications when connecting to other Bluetooth devices.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/hci_event.c within the hci_user_passkey_notify_evt() and hci_keypress_notify_evt() functions. The root cause is a race condition where hci_conn lookup and field access are performed without holding the hdev lock, allowing the connection object to be freed concurrently by another thread. An attacker can trigger this by initiating or manipulating Bluetooth pairing events. The fix involves extending the hci_dev_lock critical section to encompass all connection object usage within these handlers. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel All versions prior to the fixed commits in 6.1, 6.6, 6.8, and 6.9 branches
Timeline
- 2026-04-09: other: Patch authored
- 2026-05-27: advisory: CVE published
References
- https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47
- https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2
- https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993
- https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7
- https://git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8