Executive brief
The Linux kernel's Bluetooth stack contains a use-after-free vulnerability in the suspend code path that manages the device accept list. An attacker with local access could exploit this race condition to cause a kernel crash or potential privilege escalation, affecting system stability and security.
Technical details
The vulnerability is a use-after-free (UAF) in the Bluetooth HCI synchronization code during system suspend. The hci_update_event_filter_sync() function iterates through hdev->accept_list while holding hdev->req_lock, but accept-list modifications are protected by hdev->lock. This lock ordering allows remove_device() to free list entries that are currently being traversed, causing a read of freed memory. The race occurs when hci_set_event_filter_sync() blocks waiting for a controller response, during which remove_device() can execute and free the current list entry. The fix snapshots remote-wakeup addresses under proper locking before sending HCI commands, preventing list traversal across the controller wait period.
Affected products
- Linux Linux Kernel <UNKNOWN>
Timeline
- 2026-09-04: disclosed