Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_conn_sync() There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:58.397Z",
  "pubdate": "2026-08-15T13:17:58.397Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel Bluetooth subsystem, specifically within the hci_conn component when handling connection abort operations.\nThe vulnerability arises due to a race condition where a connection structure (conn) can be deallocated while an asynchronous hci_sync task is actively referencing it, lacking the necessary reference counting mechanisms during execution.\nSuccessful exploitation of this flaw can lead to memory corruption, potential kernel crashes, or arbitrary code execution within the context of the kernel, depending on memory layout and allocator state.\nThe affected system is the Linux kernel utilizing the Bluetooth Host Controller Interface (HCI) layer.\nAttackers capable of triggering concurrent connection teardown and synchronization routines could theoretically leverage this race condition.\nThe risk implication is severe due to the potential for kernel-level compromise, requiring local access or interaction through Bluetooth interfaces depending on the exact driver and stack exposure.",
  "technicalDetails": "The vulnerability resides in the Linux kernel Bluetooth subsystem, specifically within the abort_conn_sync() function in the net/bluetooth/hci_conn.c or related source files handling HCI connection synchronization.\nThe root cause is a lack of proper reference counting management for the hci_conn structure during asynchronous task execution within the hci_sync framework.\nWhen abort_conn_sync() is invoked to handle connection abort procedures, a background or queued hci_sync task may operate on the hci_conn object.\nIf the underlying connection is closed, dropped, or freed concurrently while the hci_sync task is still scheduled or running, the object is deallocated.\nSubsequent references to the freed memory region by the executing hci_sync task result in a Use-After-Free (UAF) condition.\nThe attack flow involves initiating a Bluetooth connection state change or termination that triggers the abort sequence while manipulating timing to coincide with the asynchronous execution of the synchronization task.\nBecause the execution relies on asynchronous kernel workqueues or task queues, precise race condition timing or multi-threaded interaction via local system calls or crafted HCI events is typically required.\nPrivilege and authentication requirements depend on the system configuration and whether local user-space access or malicious Bluetooth devices can trigger the vulnerable code paths through HCI commands or socket interactions.\nPost-exploitation impact includes kernel panics leading to Denial of Service (DoS), unpredictable system behavior, or potential local privilege escalation if the freed memory is successfully reallocated and controlled by an attacker."
}