Executive brief
A memory safety issue was identified in the Linux kernel's Bluetooth management component. This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized actions by exploiting a race condition when adding and removing Bluetooth devices simultaneously. This impacts the stability and reliability of systems using Bluetooth.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/mgmt.c within the add_device_complete() function. The root cause is a locking failure where the function dereferences an hci_conn_params object without holding the required hci_dev_lock. A concurrent MGMT_OP_REMOVE_DEVICE operation can trigger hci_conn_params_free(), leading to a kfree() of the object while add_device_complete() is still accessing it. This race condition was confirmed via KASAN (KernelAddressSanitizer) reports showing a read-after-free during the hci_cmd_sync_work kworker execution. The fix involves properly holding hci_dev_lock across the lookup and dereference operations.
Affected products
- Linux Linux kernel 7.0.11
Timeline
- 2026-06-15: disclosed: Vulnerability fix authored
- 2026-07-18: patched: Fix committed to stable tree
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/9531014c60c804e16099885d4a98aedcf31bce8d
- https://git.kernel.org/stable/c/b346efa825b5e4386f19bc63f81141652d496ec4
- https://git.kernel.org/stable/c/caed4a96d55757c139a899744657c032b6186665
- https://git.kernel.org/stable/c/e4369e4e970f3fa4676b76be14c1d315c87f22b6
- https://git.kernel.org/stable/c/fa85d985f614bc3feb343000f14a1072e99b0df1