PT-2026-34405 · Linux · Linux Kernel
CVE-2026-31500
·
Published
2026-04-22
·
Updated
2026-07-28
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A race condition exists in the Bluetooth component where the
btintel hw error() function issues synchronous HCI commands without holding the hci req sync lock lock. This allows it to race against btintel shutdown combined(), which also executes synchronous commands under the same lock. Concurrent manipulation of hdev->req status and hdev->req rsp can lead to a situation where the close path frees the response socket buffer (skb) first, resulting in a slab-use-after-free in kfree skb() when the hardware error path continues execution.Recommendations
Wrap the recovery sequence in
hci req sync lock and hci req sync unlock to ensure it is serialized with all other synchronous HCI command issuers.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel