Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_past_sync() callback Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have reused. Hold refcount to avoid that.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-15T13:17:58.083Z",
  "pubdate": "2026-08-15T13:17:58.083Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem, specifically within the hci_sync component.\nThe vulnerability arises due to improper reference counting of connection objects during the execution of the hci_past_sync() callback.\nIf successfully exploited, an attacker could cause a denial of service, kernel crashes, or potentially achieve arbitrary code execution within the kernel context.\nThe affected system is the Linux kernel, specifically impacting Bluetooth host controller interface synchronization routines handling connection validation.\nRisk implications include system instability and potential privilege escalation for local users capable of interacting with the Bluetooth subsystem.\nAttacker capabilities involve manipulating connection lifecycles to trigger memory corruption via use-after-free conditions.\nExploitation requirements include local execution context or the ability to initiate and terminate Bluetooth connections rapidly to induce memory reuse patterns by the kmalloc allocator.",
  "technicalDetails": "The root cause of the vulnerability resides in the handling of connection reference counts within the Linux kernel Bluetooth subsystem, specifically inside the hci_sync synchronization mechanism.\nDuring the execution of the hci_past_sync() callback, connection objects are processed without adequately holding their reference counts.\nConsequently, a connection pointer can be freed while still in use, leading to a scenario where freed memory pointers are passed to validation functions such as hci_conn_valid().\nBecause the underlying memory allocator, kmalloc, may rapidly reallocate the freed memory region for alternate kernel objects, referencing the stale pointer results in a classic use-after-free condition.\nThe vulnerable component is the hci_sync module within the net/bluetooth/hci_sync.c source file of the Linux kernel.\nThe attack flow proceeds as follows: an attacker initiates a sequence of events that triggers the asynchronous hci_past_sync() callback for a targeted Bluetooth connection object. As the connection object is prematurely released and its memory reclaimed, a subsequent validation check via hci_conn_valid() accesses the dangling pointer.\nIf the memory has been reallocated and populated with attacker-controlled data or alternative kernel structures, this access leads to undefined behavior, memory corruption, or type confusion.\nExploitation requires local access or the capability to trigger Bluetooth stack operations that manage connection states and synchronization callbacks.\nPost-exploitation impact includes kernel panics resulting in denial of service, memory corruption affecting adjacent kernel data structures, and theoretical escalation of privilege if deterministic heap manipulation is achieved."
}