Executive brief
A security vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to system instability or crashes. The issue occurs when the system handles specific types of Bluetooth connection requests, potentially allowing a local or nearby attacker to trigger a memory error. This could result in a denial-of-service condition where the system stops responding or restarts unexpectedly.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/hci_event.c within the hci_conn_request_evt() function. When the HCI_PROTO_DEFER flag is set, the function fails to maintain the hdev->lock while calling hci_connect_cfm(). This race condition allows the connection object to be deleted concurrently by another process, leading to a use-after-free when the confirmation function attempts to access the connection data. The vulnerability primarily affects SCO and ISO protocols during deferred setup listening. Patches have been released across multiple stable kernel branches to ensure the lock is held throughout the connection request lifecycle.
Affected products
- Linux Linux 3.17 to 6.9.x
Timeline
- 2026-06-24: advisory: CVE-2026-53072 published by NVD
- 2026-04-13: patched: Initial fix committed to mainline kernel
References
- https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3
- https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f
- https://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2
- https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4
- https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065
- https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e
- https://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473a