CVE-2026-46275 (GCVE-0-2026-46275)

Vulnerability from cvelistv5 – Published: 2026-06-08 14:30 – Updated: 2026-08-05 12:30
VLAI
Title
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 78aad93e938f013d9272fe0ee168f27883afa95c (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < e2d19969c8d9198ecc3090bcd5312ecd503a3339 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < c85cff648a2bc92322912db5f1727ad05afae7b6 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 9d20d48be2c4a071fb015eb09bda2cecd25daf34 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 81c7a3c22a0f2808cf4ae0b4908f59763b23606d (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 7338031946bd06f6dff149e67b60c4cd083bfea8 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b (git)
Affected: cd27019bc149f20f12ebec943c2b4c775745a5a0 (git)
Affected: aea63181b6fcb6b9ccde1ada9ea51be19c4015af (git)
Affected: 0d234d1135dcd8876de0576dac68efd0a87eef87 (git)
Affected: 3fe978892ab46efc2f3830d9abc015eff72caaf9 (git)
Affected: 0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f (git)
Affected: 4.14.203 , < 4.15 (semver)
Affected: 4.19.153 , < 4.20 (semver)
Affected: 5.4.73 , < 5.5 (semver)
Affected: 5.8.17 , < 5.9 (semver)
Affected: 5.9.2 , < 5.10 (semver)
Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_ldisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78aad93e938f013d9272fe0ee168f27883afa95c",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "e2d19969c8d9198ecc3090bcd5312ecd503a3339",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "c85cff648a2bc92322912db5f1727ad05afae7b6",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "9d20d48be2c4a071fb015eb09bda2cecd25daf34",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "81c7a3c22a0f2808cf4ae0b4908f59763b23606d",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "7338031946bd06f6dff149e67b60c4cd083bfea8",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cd27019bc149f20f12ebec943c2b4c775745a5a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aea63181b6fcb6b9ccde1ada9ea51be19c4015af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d234d1135dcd8876de0576dac68efd0a87eef87",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fe978892ab46efc2f3830d9abc015eff72caaf9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.153",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.73",
              "versionType": "semver"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10",
              "status": "affected",
              "version": "5.9.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_ldisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.153",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.73",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.9.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n\nVulnerabilities leading to Use-After-Free (UAF) and Null Pointer\nDereference (NPD) conditions were observed in the lifecycle management\nof hci_uart.\n\nThe primary issue arises because the workqueues (init_ready and\nwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READY\nflag is set during TTY close. If a hangup occurs before setup completes,\nhci_uart_tty_close() skips the teardown of these workqueues and\nproceeds to free the `hu` struct. When the scheduled work executes\nlater, it blindly dereferences the freed `hu` struct.\n\nFurthermore, several data races and UAFs were identified in the teardown\nsequence:\n1. Calling hci_uart_flush() from hci_uart_close() without effectively\n   disabling write_work causes a race condition where both can concurrently\n   double-free hu-\u003etx_skb. This happens because protocol timers can\n   concurrently invoke hci_uart_tx_wakeup() and requeue write_work.\n2. Calling hci_free_dev(hdev) before hu-\u003eproto-\u003eclose(hu) causes a UAF\n   when vendor specific protocol close callbacks dereference hu-\u003ehdev.\n3. In the initialization error paths, failing to take the proto_lock\n   write lock before clearing PROTO_READY leads to races with active\n   readers. Additionally, hci_uart_tty_receive() accesses hu-\u003ehdev\n   outside the read lock, leading to UAFs if the initialization error\n   path frees hdev concurrently.\n\nFix these synchronization and lifecycle issues by:\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,\n   followed immediately by a cancel_work_sync(\u0026hu-\u003ewrite_work). Clearing\n   the flag locks out concurrent protocol timers from successfully invoking\n   hci_uart_tx_wakeup(), effectively rendering the cancellation permanent\n   and preventing the tx_skb double-free.\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip\n   hu-\u003eproto-\u003eflush(). This is perfectly safe in the tty_close path\n   because hu-\u003eproto-\u003eclose() executes shortly after, which intrinsically\n   purges all protocol SKB queues and tears down the state.\n3. Relocating hu-\u003eproto-\u003eclose(hu) strictly prior to hci_free_dev(hdev)\n   across all close and error paths to prevent vendor-level UAFs.\n4. Moving the hdev-\u003estat.byte_rx increment in hci_uart_tty_receive()\n   inside the proto_lock read-side critical section to safely synchronize\n   with device unregistration.\n5. Adding cancel_work_sync(\u0026hu-\u003ewrite_work) to hci_uart_close() to safely\n   flush the workqueue before hci_uart_flush() is invoked via the HCI core.\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across\n   all paths to prevent permanently breaking user-space retry capabilities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local TTY control (TIOCSETD to N_HCI, HCIUARTSETPROTO ioctl, hangup/close) gated by CAP_NET_ADMIN at hci_uart_tty_open(); the bugs are in driver lifecycle teardown, not in processing of remote Bluetooth over-the-air packets.\nAC:L - The attacker controls both sides of every race by concurrently opening/closing the TTY line discipline, issuing HCIUART ioctls, and timing hangup against in-flight workqueues and protocol timers; UAF conditions are reliably winnable without luck-dependent memory layout.\nPR:L - hci_uart_tty_open() explicitly requires CAP_NET_ADMIN, and adapter teardown paths are similarly admin-gated; CAP_NET_ADMIN is obtainable by an unprivileged user inside a user namespace, satisfying the Low privileges threshold rather than High.\nUI:N - Once the attacker has the required local TTY/HCI access, triggering the UAF or double-free races requires no action from a separate victim user.\nS:U - The vulnerability corrupts kernel heap memory within the kernel\u0027s own security boundary; successful exploitation yields kernel privilege escalation, not a cross-boundary escape such as VM or sandbox breakout.\nC:H - Multiple use-after-free conditions on the hci_uart and hci_dev structures allow dereferencing attacker-influenced freed memory, providing a standard kernel info-leak primitive consistent with UAF severity guidance.\nI:H - The UAF and hu-\u003etx_skb double-free races enable control of freed slab objects and heap grooming, providing a path to arbitrary kernel memory corruption and potential code execution in kernel context.\nA:H - Use-after-free and double-free in kernel workqueue and teardown paths reliably cause kernel oops or panic, and can be triggered repeatedly to deny availability of the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:58.918Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339"
        },
        {
          "url": "https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34"
        },
        {
          "url": "https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d"
        },
        {
          "url": "https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894"
        },
        {
          "url": "https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b"
        }
      ],
      "title": "Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46275",
    "datePublished": "2026-06-08T14:30:54.232Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-08-05T12:30:58.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46275",
      "date": "2026-10-03",
      "epss": "0.00132",
      "percentile": "0.02335"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.