Executive brief
The Linux kernel's Bluetooth subsystem contains a reference counting flaw in its connection synchronization code. If a Bluetooth connection object is freed while certain asynchronous operations are in progress, the kernel could attempt to access memory that has already been released, potentially causing a system crash or creating a stability issue. This affects any system using Bluetooth connectivity.
Technical details
The vulnerability is a use-after-free (UAF) condition in the Bluetooth HCI synchronous connection handlers (hci_connect_acl_sync and hci_connect_le_sync). The root cause is insufficient reference counting: the connection object pointer is passed to asynchronous tasks without holding a reference, allowing the object to be freed while the task is still executing. An attacker with local access and the ability to trigger Bluetooth connection events could exploit this condition. The fix adds hci_conn_get/put calls around the async queue operations to hold the connection reference for the duration of the operation, and adds explicit completion callbacks to release the reference.
Affected products
- Linux Linux kernel multiple versions (patch backported across 2.6.11 through 6.9 and stable branches)
Timeline
- 2026-08-28: disclosed
- 2026-07-28: patched: upstream commit 2f5d635ad5906b0235bc0c870e8beba3116e1e98