HIGH
bluetooth btintel HwError UAF
CVE-2026-31500
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock. When both paths manipulate hdev->req_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb(). Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer. Below is the data race report and the kasan report: BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030 write/free by task ioctl/22580: btintel_shutdown_combined+0xd0/0x360 drivers/bluetooth/btintel.c:3648 hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246 hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526 BUG: KASAN: slab-use-after-free in sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202 Read of size 4 at addr ffff888144a738dc by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260
02KernelScan AI Analysis
Risk summary
A race condition in Intel Bluetooth driver error handling can cause the kernel to access freed memory, potentially leading to system crashes or memory corruption. This occurs when Bluetooth device shutdown operations race with hardware error recovery, causing one path to free response buffers while another path is still using them.
Vulnerability analysis
Root Cause: The btintel_hw_error() function issues synchronous HCI commands (__hci_cmd_sync) without holding the hci_req_sync_lock, allowing it to race with btintel_shutdown_combined() during device close operations. Both functions manipulate shared hdev->req_status/req_rsp fields concurrently, leading to the shutdown path freeing response skb buffers while the hardware error path is still accessing them.
Attack Surface: Local attack surface requiring physical access to Bluetooth hardware or the ability to trigger hardware errors. The vulnerability is triggered through normal Bluetooth device operations (close/error handling) and does not require network access or special privileges beyond basic Bluetooth device interaction.
Fix Mechanism: The patch wraps the entire hardware error recovery sequence in hci_req_sync_lock/unlock calls, serializing it with all other synchronous HCI command issuers. This prevents concurrent access to the shared request/response state and eliminates the race condition that caused the use-after-free.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.1 | 6.1.175 | 7e041d0aad1d |
| 6.12 | 6.12.80 | e10a4cb72468 |
| 6.18 | 6.18.21 | 66696648af47 |
| 6.19 | 6.19.11 | f7d84737663a |
| 6.6 | 6.6.131 | 5f84e845648d |
| mainline | 7.0 | 94d8e6fe5d08 |