Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T08:16:54.690Z",
  "pubdate": "2026-08-28T08:16:54.690Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists within the Linux kernel's Bluetooth subsystem, specifically concerning the hci_sync synchronization mechanism.\nThe vulnerability stems from inadequate reference counting of connection objects during the execution of hci_connect_acl/le_sync() callbacks.\nIf a connection object (conn) is deallocated while the hci_sync task is actively processing or referencing it, the kernel may attempt to access memory that has already been freed, leading to a UAF condition.\nThis flaw impacts the stability and security of the Linux kernel's Bluetooth stack, potentially allowing local attackers to trigger kernel panics or achieve arbitrary code execution through memory corruption.\nThe risk implication is significant as it affects the core Bluetooth communication layer. Exploitation requires the attacker to be capable of triggering specific Bluetooth connection states while simultaneously causing the deallocation of the underlying connection structure, making it a timing-sensitive operation.\nNo specific authentication or network exposure requirements beyond the ability to interact with the Bluetooth stack are natively required for local exploitation.",
  "technicalDetails": "The vulnerability resides in the Linux kernel Bluetooth stack, specifically within the hci_sync.c component responsible for managing connection state transitions. The flaw is rooted in an object lifecycle management issue regarding the 'conn' structure during the execution of 'hci_connect_acl_sync' and 'hci_connect_le_sync' functions.\nIn the Linux kernel's asynchronous task scheduling model, 'hci_sync' tasks execute as part of a workqueue or synchronous callback mechanism. These callbacks interact directly with 'hci_conn' objects. The vulnerability occurs because these synchronization callbacks were previously failing to increment the reference count of the connection object they were operating upon.\nBecause the 'conn' object lifecycle is managed by the kernel's reference counting mechanism (kref), if the connection is closed, disconnected, or terminated by a concurrent process, the object may be freed (via 'hci_conn_del' or equivalent cleanup paths) while a 'hci_sync' task is still queued or mid-execution. When the 'hci_sync' task later attempts to access the 'conn' pointer, it accesses dangling memory.\nThe attack flow involves triggering the asynchronous connection routines for ACL or LE links. An attacker must create conditions where the connection setup is interrupted or the connection object is destroyed while the kernel is still processing the synchronization request. By manipulating the timing of Bluetooth state transitions, an attacker can ensure the 'conn' pointer points to a memory region that has been returned to the slab allocator.\nOnce the UAF is triggered, the kernel's access to the freed memory can result in undefined behavior. If an attacker can spray the slab cache with controlled data before the 'hci_sync' task accesses the dangling pointer, they may gain control over kernel execution flow. This could lead to local privilege escalation or arbitrary code execution within the kernel context.\nThe scope of the affected components is limited to the hci_sync mechanisms within the Linux Bluetooth stack. The remediation requires the explicit use of 'hci_conn_hold()' and 'hci_conn_drop()' to ensure that the reference count is incremented upon entry to the synchronous connection tasks and decremented only after the task has completed its operations, effectively preventing the garbage collector or the cleanup path from freeing the object prematurely."
}