Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:58.190Z",
  "pubdate": "2026-08-15T13:17:58.190Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel Bluetooth subsystem, specifically within the hci_sync component.\nThe vulnerability arises due to a lack of proper reference counting when handling connection objects during asynchronous execution tasks.\nAn attacker capable of triggering specific Bluetooth Periodic Advertising Sync (PA sync) operations could potentially exploit this flaw to induce memory corruption.\nThis may lead to arbitrary code execution, denial of service, or escalation of privilege within the kernel context, depending on the timing and memory layout.\nThe affected system component is the hci_connect_pa_sync() callback function within the hci_sync.c source file.\nExploitation requires the ability to interact with the Linux kernel Bluetooth stack, typically via local access or adjacent network proximity depending on the hardware interface exposure.",
  "technicalDetails": "The vulnerability is rooted in a race condition and lifetime management issue involving the connection structure (conn) within the Bluetooth host controller interface synchronization routines.\nSpecifically, the function hci_connect_pa_sync() initiates tasks that execute asynchronously via the hci_sync framework.\nPreviously, the implementation failed to acquire and hold an appropriate reference count (refcount) on the conn object during the execution of the callback.\nIf the underlying connection object is prematurely torn down or freed while the asynchronous hci_sync task is still actively referencing it, a Use-After-Free condition occurs.\nAn attacker can exploit this by inducing conditions that rapidly establish and tear down Bluetooth connections or synchronization states while asynchronous sync tasks are pending.\nWhen the kernel subsequently attempts to access the deallocated memory region associated with the conn pointer, it results in undefined behavior, memory corruption, or a system crash.\nThe vulnerable component is identified as the hci_connect_pa_sync() callback handler in the Linux kernel Bluetooth subsystem (net/bluetooth/hci_sync.c).\nThe attack vector involves interacting with the Bluetooth stack to trigger PA sync procedures, requiring local execution capabilities or proximity-based Bluetooth interface access.\nSuccessful exploitation compromises kernel integrity, potentially allowing malicious actors to execute arbitrary code with kernel-level privileges."
}