HIGH
bluetooth ConnSync UAF
CVE-2026-80692
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.2HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the Linux Bluetooth subsystem's synchronous connection management path. A local user with Bluetooth access, or an adjacent Bluetooth device during connection establishment, could race a connection abort with the sync task to trigger access to freed memory, potentially leading to kernel code execution or a system crash.
Vulnerability analysis
When a Bluetooth connection attempt is queued for synchronous command processing, the connection object is passed to the sync task without holding a reference count on it. If the connection is aborted or dequeued while the sync task is still running, the task accesses memory that has already been freed, resulting in a use-after-free. The fix takes a reference on the connection object before queuing it and releases that reference in the callback that runs when the operation finishes (and on error paths), ensuring the object remains valid for the entire lifetime of the sync operation. This is reachable by any local user with access to the Bluetooth stack, or potentially by an adjacent Bluetooth device influencing connection timing, and requires Bluetooth hardware to be present and enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | — | 6.12.114 | a4de6fc95b2f |
| 6.18 | — | 6.18.57 | 9a77f296aff4 |
| 6.6 | 6.6.51 | 6.6.160 | f0a544ef6e38 |
| 6.8 | 6.8.9 | 6.9 | 301a4e2e8931 |
| 7.1 | — | 7.1.8 | 2f5d635ad590 |
| mainline | — | 7.2 | — |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |