PT-2026-64654 · Linux · Linux

CVE-2026-64433

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix UAF of hci conn params in add device complete
add device complete() runs from the hci cmd sync work kworker, which holds only hci req sync lock and not hci dev lock. It calls hci conn params lookup() and then dereferences the returned object (params->flags) without taking hci dev lock:
params = hci conn params lookup(hdev, &cp->addr.bdaddr,
				le addr type(cp->addr.type));
...
device flags changed(NULL, hdev, &cp->addr.bdaddr,
		   cp->addr.type, hdev->conn flags,
		   params ? params->flags : 0);
hci conn params lookup() walks hdev->le conn params and is documented to require hdev->lock. A concurrent MGMT OP REMOVE DEVICE (remove device()), which does run under hci dev lock, can call hci conn params free() to list del() and kfree() the very object the lookup returned, so the subsequent params->flags read touches freed memory [0].
Hold hci dev lock() across the hci conn params lookup() and the read of params->flags (and the matching event emission) so the lookup result cannot be freed by a concurrent remove device() before it is used, honouring the locking contract of hci conn params lookup().
[0]: (trailing page/memory-state dump trimmed) BUG: KASAN: slab-use-after-free in add device complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388
CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: hci0 hci cmd sync work Call trace: show stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) dump stack lib/dump stack.c:94 [inline] dump stack lvl+0xb4/0xd4 lib/dump stack.c:120 print address description mm/kasan/report.c:378 [inline] print report+0x118/0x5d8 mm/kasan/report.c:482 kasan report+0xb0/0xf4 mm/kasan/report.c:595 asan report load1 noabort+0x20/0x2c mm/kasan/report generic.c:378 add device complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 hci cmd sync work+0x14c/0x240 net/bluetooth/hci sync.c:334 process one work+0x628/0xd38 kernel/workqueue.c:3289 process scheduled works kernel/workqueue.c:3372 [inline] worker thread+0x7a8/0xac0 kernel/workqueue.c:3453 kthread+0x39c/0x444 kernel/kthread.c:436 ret from fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Allocated by task 3401: kasan save stack+0x3c/0x64 mm/kasan/common.c:57 kasan save track+0x20/0x3c mm/kasan/common.c:78 kasan save alloc info+0x40/0x54 mm/kasan/generic.c:570 poison kmalloc redzone mm/kasan/common.c:398 [inline] kasan kmalloc+0xd4/0xd8 mm/kasan/common.c:415 kasan kmalloc include/linux/kasan.h:263 [inline] kmalloc cache noprof+0x1b0/0x458 mm/slub.c:5385 kmalloc noprof include/linux/slab.h:950 [inline] kzalloc noprof include/linux/slab.h:1188 [inline] hci conn params add+0x10c/0x4b0 net/bluetooth/hci core.c:2279 hci conn params set net/bluetooth/mgmt.c:5162 [inline] add device+0x5b4/0xa54 net/bluetooth/mgmt.c:7755 hci mgmt cmd net/bluetooth/hci sock.c:1721 [inline] hci sock sendmsg+0x10b4/0x1dd0 net/bluetooth/hci sock.c:1841 sock sendmsg nosec net/socket.c:727 [inline] sock sendmsg+0xe0/0x128 net/socket.c:742 sock write iter+0x250/0x390 net/socket.c:1195 new sync write fs/read write.c:595 [inline] vfs write+0x66c/0xab0 fs/read write.c:688 ksys write+0x1fc/0x24c fs/read write.c:740 do sys write fs/read write.c:751 [inline] se sys write fs/read write.c:748 [inline] arm64 sys write+0x70/0xa4 fs/read write.c:748 invoke syscall arch/arm64/kernel/syscall.c:35 [inline] invoke syscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49 el0 svc common.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132 do el0 svc+0x44/0x5c arch/arm64/kernel/syscall.c:151 el0 svc+0x38/0xac arch/arm64/kernel/entry-common.c:724 el0t 64 sync handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743 el0t 64 sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Freed by task 3740: kasan save stack+0x3c/0x64 ---truncated---
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64433

Affected Products

Linux