Executive brief
A vulnerability has been identified in the Linux kernel's Bluetooth subsystem that could allow an attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system handles specific Bluetooth Broadcast Isochronous Group (BIG) connections, where a technical error allows the system to use memory that has already been freed. This could lead to system instability, service outages, or a compromise of the device's security if an attacker is within Bluetooth range.
Technical details
A use-after-free (UAF) vulnerability exists in the net/bluetooth/hci_conn.c component of the Linux kernel. The flaw is located in the create_big_sync and create_big_complete functions, where the kernel fails to properly validate the state of a connection object (hci_conn) across asynchronous boundaries. Specifically, create_big_complete() would unconditionally dereference a connection pointer even if the connection had become stale or was already freed, leading to a UAF during error handling via hci_connect_cfm() and hci_conn_del(). The fix introduces hci_conn_valid() checks and implements proper reference counting using hci_conn_get() and hci_conn_put() to ensure the object remains allocated until the completion callback finishes.
Affected products
- Linux Linux Kernel eca0ae4aea66 to 0beddb0c380b, 1750a2df0eab, 6823f730bf19, dc34f8d8240f, f8eaf92c57ad
Timeline
- 2026-05-28: advisory: CVE-2026-46111 published by NVD
- 2026-05-06: patched: Mainline kernel patch committed
References
- https://git.kernel.org/stable/c/0beddb0c380bed5f5b8e61ddbe14635bb73d0b41
- https://git.kernel.org/stable/c/1750a2df0eab61dc421a7afae74abdd239a44b85
- https://git.kernel.org/stable/c/6823f730bf195fc296d9edd09e2ca94bc1ff5584
- https://git.kernel.org/stable/c/dc34f8d8240f25dd137dc2758ebbcc75e3779142
- https://git.kernel.org/stable/c/f8eaf92c57ad99358dd372580d5ff87623343a72