bluetooth SSP UAF

Vulnerability analysis

The vulnerability occurs in hci_user_passkey_notify_evt() and hci_keypress_notify_evt() where hci_conn lookup and subsequent field access (conn->passkey_notify, conn->passkey_entered, conn->dst, conn->type, conn->dst_type) are not protected by hdev lock. A connection object can be freed by another thread between the hci_conn_hash_lookup_ba() and field access, creating a classic use-after-free. The fix extends hci_dev_lock to cover all connection usage and adds common unlock paths for early exits. The UAF is on a heap-allocated hci_conn object; exploitation enables both information disclosure (reading freed heap/slab data) and memory corruption (writing to freed object fields or management notification callbacks). Attack vector is Adjacent (Bluetooth radio range), not Local — the attacker need not have local system access, only physical proximity to initiate Bluetooth pairing.