Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:58.297Z",
  "pubdate": "2026-08-15T13:17:58.297Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel Bluetooth subsystem, specifically within the hci_sync module. This security flaw involves a Use-After-Free (UAF) condition related to connection handling during the hci_connect_big_sync() callback.\nThe vulnerability type is a Use-After-Free, which can potentially lead to memory corruption, system crashes, or arbitrary code execution within the kernel context if an attacker successfully triggers the race condition.\nThe affected system is the Linux kernel, specifically components utilizing Bluetooth synchronization and connection routines. The risk implications include denial of service and potential kernel-level compromise.\nAttacker capabilities require local access or the ability to interact with the Bluetooth stack to manipulate connection states and trigger asynchronous hci_sync tasks while the underlying connection object is being deallocated.",
  "technicalDetails": "The vulnerability stems from a lack of proper reference counting for the connection object (conn) while an asynchronous hci_sync task is actively executing in the hci_connect_big_sync() callback function within the Linux kernel Bluetooth subsystem.\nThe vulnerable component is the Bluetooth Host Controller Interface (HCI) synchronization handler, specifically within the hci_sync.c source file and the hci_connect_big_sync() function.\nThe root cause of the vulnerability is a theoretical Use-After-Free condition where the connection structure (conn / hcon) could be prematurely freed while background synchronization tasks are still referencing the memory address.\nExploitation occurs when a race condition is triggered between the deallocation of the Bluetooth connection object and the execution of the asynchronous hci_sync task. If the connection object is freed while the background task attempts to access it, a Use-After-Free condition arises.\nTo exploit this, an adversary would need to coordinate timing such that the connection is terminated and freed precisely when the hci_connect_big_sync() callback is processing the hcon pointer.\nThe resolution for this vulnerability involves holding a reference count on the connection object via the hci_sync task to ensure the memory remains allocated during execution, as well as explicitly handling NULL hcon pointers to maintain expected operational behavior and prevent null pointer dereferences."
}