Junglewise Threat Intelligence

CVE-2026-46275: Linux Kernel Bluetooth hci_uart use-after-free and race conditions

CVE-2026-46275 · Severity: info · CVSS 0 · Published 2026-06-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security issue was identified in the Linux kernel's Bluetooth subsystem that could lead to system instability or crashes. The problem occurs when a Bluetooth serial device is disconnected or fails to initialize properly, causing the system to attempt to use memory that has already been cleared. This could potentially be used by a local attacker to cause a denial-of-service or execute unauthorized actions on the affected system.

Technical details

Multiple vulnerabilities including Use-After-Free (UAF), Null Pointer Dereference (NPD), and race conditions exist in the hci_uart driver (hci_ldisc.c). The primary root cause is improper lifecycle management where workqueues (init_ready and write_work) are not correctly synchronized or cancelled during TTY close or initialization failure. Specifically, if a hangup occurs before setup completes, the driver may free the 'hu' structure while scheduled work still references it. Additionally, improper ordering of hci_free_dev() and protocol close callbacks leads to vendor-specific UAFs. Attackers with local access could trigger these races to cause kernel panics or potentially achieve local privilege escalation. The fix involves re-ordering teardown sequences, ensuring PROTO_READY is cleared before work cancellation, and properly utilizing proto_lock during state changes.

Affected products

  • Linux Linux Kernel All versions prior to the June 2026 patches

Timeline

  • 2026-05-18: other: Patch submitted by developer
  • 2026-06-01: patched: Commits merged into stable trees
  • 2026-06-08: advisory: CVE-2026-46275 published

References

Related threats