Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could lead to a system crash. The issue occurs when the system attempts to read a network device name that has already been deleted during a specific connection process. Exploiting this requires administrative privileges and precise timing, making it a low-risk issue for most organizations.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/bnep/core.c within the Linux kernel. The function bnep_add_connection() prematurely releases the 'bnep_session_sem' semaphore before reading 'dev->name'. This creates a race condition where the 'bnep_session()' thread can concurrently free the 'net_device' structure, specifically if triggered by a concurrent 'bnep_del_connection()' call. An attacker requires CAP_NET_ADMIN privileges to trigger the vulnerable code path. The fix involves extending the semaphore protection to encompass the device name access.
Affected products
- Linux Linux Kernel 2.6.12 to 6.9.x
Timeline
- 2026-05-12: disclosed: Vulnerability reported by Jann Horn
- 2026-06-01: patched: Fixes committed to various stable branches
- 2026-07-19: advisory: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/4907596f25b1720fa948371ac5f6c1f8da10a5bc
- https://git.kernel.org/stable/c/5506aec795135cdd4cbf4e845929155663b25055
- https://git.kernel.org/stable/c/59e932ded949fa6f0340bf7c6d7818f962fa4fd2
- https://git.kernel.org/stable/c/915a92182e2cda9cd7d2479020a44c6eda986f7c
- https://git.kernel.org/stable/c/a75bbcb10cb21acc169b785e9804f57d97873a9c
- https://git.kernel.org/stable/c/b21805258d7e926adfd455fc820a447b90da3b82
- https://git.kernel.org/stable/c/e7578529b97e5d4e439cf8f3e637c2303015338f