Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a local attacker to cause a system crash or potentially execute unauthorized code. This occurs when the system handles new Bluetooth connections, where a race condition allows a connection to be closed and its memory freed while the system is still trying to use it. This could impact the stability of devices using Bluetooth or lead to a denial of service.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/l2cap_sock.c within the l2cap_sock_new_connection_cb() function. The root cause is a race condition where the parent socket lock is released before the child socket's channel is dereferenced. During this window, another task can accept and free the child socket from the accept queue. The fix reworks the ->new_connection() operation to ensure the core L2CAP layer, rather than the callback, manages the child channel's lifetime, using a pre-allocated channel and linking it to the connection list before the callback is invoked. This ensures the channel remains valid even after the parent lock is dropped.
Affected products
- Linux Linux 8ffb929098a56939ac71509302eeab5b207bf262 to fixed versions
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
References
- https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700
- https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40
- https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a
- https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae
- https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87
- https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820