Executive brief
The Linux kernel's Bluetooth subsystem contains a use-after-free vulnerability in the reset command handler that can lead to kernel memory corruption. An attacker with local access could trigger a race condition between a Bluetooth device reset and debugfs operations to read and execute arbitrary code or crash the system.
Technical details
The vulnerability is a use-after-free (CWE-416) in the hci_cc_reset() function within the Bluetooth hci_event handler. The function clears LE accept and resolving lists without holding the hdev->lock mutex, while other handlers and debugfs readers rely on this lock for synchronization. A race condition allows a debugfs reader (e.g., white_list_show) to dereference freed list entries while hci_cc_reset() is clearing them, leading to slab-use-after-free as demonstrated by the KASAN report. The fix involves wrapping both list_clear() operations with hdev->lock to ensure proper serialization. The vulnerability requires local access to both trigger a Bluetooth reset and access the debugfs interface.
Affected products
- Linux Linux kernel affected versions prior to fix commit
Timeline
- 2026-09-04: disclosed