Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth USB driver (btusb) that could lead to system instability or crashes. When a Bluetooth controller fails to register correctly, the system may attempt to access or free memory that has already been released. This could potentially be exploited to cause a denial-of-service (system crash) or lead to further security compromises.
Technical details
A use-after-free (UAF) and double-free vulnerability exists in the btusb_probe function within drivers/bluetooth/btusb.c of the Linux kernel. The flaw is triggered when hci_register_dev fails; the driver previously failed to properly release sibling interfaces (diag and isoc), leading to inconsistent state when these interfaces are eventually disconnected. An attacker with the ability to trigger registration failures or manipulate USB device states could potentially cause a kernel panic or execute arbitrary code, though the latter is significantly more complex. The fix introduces an error handling path (err_release_siblings) that explicitly nullifies and releases these interfaces using usb_driver_release_interface.
Affected products
- Linux Linux Kernel 2.6.27 to 6.6.145
Timeline
- 2026-06-04: other: Patch authored by Johan Hovold
- 2026-07-25: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f
- https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc
- https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c
- https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23
- https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383
- https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b
- https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc