CVE-2026-80692 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
There is theoretical UAF if the conn is freed while the hci_sync task is running.
Hold refcount to avoid that.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The identified vulnerability resides within the Linux kernel Bluetooth subsystem, specifically affecting the HCI synchronization layer responsible for managing ACL and LE sync connections. The core issue stems from a reference counting deficiency in the functions hci_connect_acl and hci_connect_le_sync. These callbacks are invoked during the asynchronous task processing of the HCI sync mechanism, which handles complex state transitions and connection establishment procedures. Under normal operation, these tasks maintain references to connection structures to ensure data integrity while operations proceed. However, under specific race conditions or timing anomalies, it is theoretically possible for a reference count decrement to occur concurrently with the execution of these callbacks, leading to premature deallocation of the connection object.
This scenario creates a Use-After-Free condition where the kernel continues to access memory that has already been returned to the allocator pool. In the context of Bluetooth HCI operations, this involves accessing structures such as hci_conn or related control blocks that describe the state and parameters of an active link. If the underlying memory is reallocated for another purpose before the callback completes its execution, subsequent dereferences will read corrupted data or execute invalid code paths based on the new contents of that memory region. This represents a critical integrity failure within the kernel space, as it bypasses standard safety checks designed to prevent access to freed resources.
The operational impact of this vulnerability is severe due to the privileged nature of the Linux kernel environment. An attacker who can trigger the specific race condition may achieve arbitrary code execution with root privileges by manipulating the contents of the reallocated memory to point to malicious shellcode or exploit primitives such as ROP chains. Alternatively, even without successful exploitation for code execution, the vulnerability poses a significant risk to system stability and availability. The use-after-free error can lead to kernel panics, unexpected reboots, or silent data corruption within network stacks, effectively resulting in a Denial of Service against the host machine. This is particularly concerning given that Bluetooth interfaces are often exposed to wireless environments where remote attackers might attempt to induce these race conditions through crafted packets or rapid connection attempts.
From a classification perspective, this flaw aligns with CWE-416, Use After Free, which describes situations where software uses memory after it has been freed, leading to unpredictable behavior and potential security breaches. Furthermore, the exploitation technique relates to ATT&CK tactic TA0005, Defense Evasion, specifically through techniques that involve manipulating kernel objects or exploiting race conditions to bypass standard execution controls. The vulnerability highlights a common class of concurrency bugs in operating system kernels where asynchronous task management must carefully coordinate with reference counting mechanisms to prevent lifetime mismatches between object creation and destruction.
Mitigation strategies primarily focus on ensuring the connection structure remains valid throughout the duration of the HCI sync tasks. As indicated by the resolution, holding an additional reference count during the execution of hci_connect_acl and hci_connect_le_sync callbacks prevents premature deallocation. This ensures that the memory associated with the connection object is not returned to the system allocator until all asynchronous operations referencing it have completed. System administrators should apply kernel updates provided by their distribution vendors that include this patch, as unpatched systems remain susceptible to exploitation via local or potentially remote triggers depending on Bluetooth stack configurations and exposure levels. Regular auditing of reference counting logic in network subsystems is also recommended to prevent similar concurrency-related vulnerabilities in future code revisions.