Executive brief
The Linux kernel's Bluetooth management (MGMT) subsystem contains a use-after-free vulnerability in the advertisement monitor add function. This flaw allows an attacker with local access to crash the kernel or potentially execute arbitrary code by triggering improper memory management during Bluetooth advertisement monitor operations. The vulnerability impacts system stability and security on Linux systems with Bluetooth functionality enabled.
Technical details
The vulnerability is a use-after-free (CWE-416) in the Bluetooth MGMT advertisement monitor add path, specifically in the hci_add_adv_monitor() and mgmt_add_adv_patterns_monitor_complete() functions. The root cause is an ownership race condition: the advertisement monitor is inserted into the IDR (ID Radix tree) before the MSFT (Microsoft) offload add command completes, allowing the MSFT callback to free the monitor while the management completion handler still holds a reference to it. Local attackers can trigger this via Bluetooth management sockets (hci_sock_sendmsg). The fix reallocates ownership to the pending management command until completion, ensuring the monitor is not freed during the async MSFT operation. No patch date is specified in the advisory.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-15: disclosed