CVE-2026-74302 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
hci_unregister_dev() does not disable cmd_timer and ncmd_timer before the hci_dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory (including the hdev->reset function pointer), leading to a use-after-free.
Add disable_delayed_work_sync() calls alongside the existing disable_work_sync() calls to ensure both timers are fully quiesced before teardown proceeds.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability represents a critical use-after-free condition in the Linux kernel's Bluetooth subsystem that arises during device teardown operations. The issue occurs within the hci_unregister_dev() function which manages the cleanup of HCI (Host Controller Interface) Bluetooth device structures. When a Bluetooth device is being unregistered, the function fails to properly disable two critical timers before the underlying hci_dev structure is freed from memory. This timing gap creates a window where asynchronous timer callbacks can still execute and attempt to access memory that has already been deallocated, resulting in unpredictable behavior and potential system instability.
The technical flaw stems from inadequate synchronization during the device teardown process where cmd_timer and ncmd_timer are not properly quiesced before memory deallocation occurs. These timers are designed to handle command timeouts and notification processing respectively, but without proper disablement they can fire at any moment during the cleanup phase. When such a timeout occurs, the callback functions attempt to dereference pointers within the freed hci_dev structure, including the critical reset function pointer that has been overwritten or deallocated. This creates a classic use-after-free scenario where memory access violations can lead to privilege escalation, system crashes, or potentially exploitable conditions.
The operational impact of this vulnerability extends beyond simple system instability to potential security implications within embedded systems and mobile devices that rely heavily on Bluetooth connectivity. The race condition allows for arbitrary code execution if an attacker can manipulate timing conditions to trigger the timeout during device removal, particularly in environments where Bluetooth is frequently connected and disconnected. This represents a significant concern for IoT devices, smartphones, and embedded systems where such memory corruption could be leveraged to gain elevated privileges or cause persistent system failures.
The fix implemented addresses this vulnerability by adding disable_delayed_work_sync() calls in conjunction with existing disable_work_sync() mechanisms to ensure complete timer quiescence before device structure deallocation occurs. This approach aligns with established security practices for preventing race conditions and memory corruption vulnerabilities. The solution follows the principles outlined in CWE-416 which specifically addresses use-after-free conditions, and directly mitigates techniques described in ATT&CK tactic TA0004 (Privilege Escalation) where memory corruption can be exploited to gain elevated system privileges. The fix ensures that all timer work items are properly synchronized and completed before memory deallocation, preventing the scenario where freed memory could be accessed by asynchronous callbacks during device teardown operations.