In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: call disconnect callback before deleting conn
In hci_cs_disconnect, we do hci_conn_del even if disconnection failed.
ISO, L2CAP and SCO connections refer to the hci_conn without hci_conn_get, so disconn_cfm must be called so they can clean up their conn, otherwise use-after-free occurs.
ISO: ========================================================== iso_sock_connect:880: sk 00000000eabd6557 iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073 hci_dev_put:1487: hci0 orig refcnt 17 __iso_chan_add:214: conn 00000000b6251073 iso_sock_clear_timer:117: sock 00000000eabd6557 state 3 ... hci_rx_work:4085: hci0 Event packet hci_event_packet:7601: hci0: event 0x0f hci_cmd_status_evt:4346: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3107: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon 000000001696f1fd handle 2560 hci_conn_unlink:1102: hci0: hcon 000000001696f1fd hci_conn_drop:1451: hcon 00000000d8521aaf orig refcnt 2 hci_chan_list_flush:2780: hcon 000000001696f1fd hci_dev_put:1487: hci0 orig refcnt 21 hci_dev_put:1487: hci0 orig refcnt 20 hci_req_cmd_complete:3978: opcode 0x0406 status 0x0c ... <no iso_* activity on sk/conn> ... iso_sock_sendmsg:1098: sock 00000000dea5e2e0, sk 00000000eabd6557 BUG: kernel NULL pointer dereference, address: 0000000000000668 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg (net/bluetooth/iso.c:1112) bluetooth ==========================================================
L2CAP: ================================================================== hci_cmd_status_evt:4359: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3085: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon ffff88800c999000 handle 3585 hci_conn_unlink:1102: hci0: hcon ffff88800c999000 hci_chan_list_flush:2780: hcon ffff88800c999000 hci_chan_del:2761: hci0 hcon ffff88800c999000 chan ffff888018ddd280 ... BUG: KASAN: slab-use-after-free in hci_send_acl+0x2d/0x540 [bluetooth] Read of size 8 at addr ffff888018ddd298 by task bluetoothd/1175
CPU: 0 PID: 1175 Comm: bluetoothd Tainted: G E 6.4.0-rc4+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xf8/0x180 ? hci_send_acl+0x2d/0x540 [bluetooth] kasan_report+0xa8/0xe0 ? hci_send_acl+0x2d/0x540 [bluetooth] hci_send_acl+0x2d/0x540 [bluetooth] ? __pfx___lock_acquire+0x10/0x10 l2cap_chan_send+0x1fd/0x1300 [bluetooth] ? l2cap_sock_sendmsg+0xf2/0x170 [bluetooth] ? __pfx_l2cap_chan_send+0x10/0x10 [bluetooth] ? lock_release+0x1d5/0x3c0 ? mark_held_locks+0x1a/0x90 l2cap_sock_sendmsg+0x100/0x170 [bluetooth] sock_write_iter+0x275/0x280 ? __pfx_sock_write_iter+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 do_iter_readv_writev+0x176/0x220 ? __pfx_do_iter_readv_writev+0x10/0x10 ? find_held_lock+0x83/0xa0 ? selinux_file_permission+0x13e/0x210 do_iter_write+0xda/0x340 vfs_writev+0x1b4/0x400 ? __pfx_vfs_writev+0x10/0x10 ? __seccomp_filter+0x112/0x750 ? populate_seccomp_data+0x182/0x220 ? __fget_light+0xdf/0x100 ? do_writev+0x19d/0x210 do_writev+0x19d/0x210 ? __pfx_do_writev+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0x60/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 ? do_syscall_64+0x6c/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7ff45cb23e64 Code: 15 d1 1f 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d 9d a7 0d 00 00 74 13 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff21ae09b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-zfcpdump-coreUpgrade kernel-develUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade kernel-rtUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-headersUpgrade kernel-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade perfUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade python3-perfUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernel-docUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-core | Jan 27, 2026 | Jan 26, 2026 |
| Debian | — | Upgrade linux | Oct 9, 2025 | Oct 9, 2025 |
| Oracle_linux | — | Upgrade kernel | Jan 29, 2026 | Oct 7, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jan 27, 2026 | Oct 7, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-rt-develUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perfUpgrade bpftoolUpgrade kernelUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-coreUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-debug-modules-extraUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-coreUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade kernel-rtUpgrade kernel-rt-debugUpgrade kernel-modules-extra | Feb 5, 2026 | Feb 3, 2026 |
| Ubuntu | — | Upgrade linux-image-azureUpgrade linux-image-virtual-5.15Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-183-lowlatencyUpgrade linux-image-5.15.0-1063-nvidia-tegraUpgrade linux-image-5.15.0-1111-awsUpgrade linux-image-azure-lts-22.04Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-5.15.0-1111-gcp-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-genericUpgrade linux-image-5.15.0-1105-ibmUpgrade linux-image-realtime-5.15Upgrade linux-image-5.15.0-1074-xilinx-zynqmpUpgrade linux-image-aws-fipsUpgrade linux-image-5.15.0-1052-nvidia-tegra-igxUpgrade linux-image-raspiUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1111-aws-64kUpgrade linux-image-oracle-5.15Upgrade linux-image-5.15.0-1106-nvidia-lowlatencyUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.15.0-1063-nvidia-tegra-rtUpgrade linux-image-aws-fips-5.15Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-5.15Upgrade linux-image-aws-64k-5.15Upgrade linux-image-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-raspi-5.15Upgrade linux-image-azure-fips-5.15Upgrade linux-image-oem-20.04cUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-5.15.0-1103-intel-iot-realtimeUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-kvm-5.15Upgrade linux-image-nvidiaUpgrade linux-image-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1110-realtimeUpgrade linux-image-5.15.0-1111-aws-fipsUpgrade linux-image-ibm-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1116-azure-fdeNo solution existsUpgrade linux-image-5.15.0-1106-nvidiaUpgrade linux-image-generic-5.15Upgrade linux-image-lowlatency-5.15Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-azure-5.15Upgrade linux-image-generic-64k-5.15Upgrade linux-image-azure-fipsUpgrade linux-image-gkeop-5.15Upgrade linux-image-azure-fde-5.15Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-virtualUpgrade linux-image-raspi-nolpaeUpgrade linux-image-gkeUpgrade linux-image-awsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-5.15.0-185-genericUpgrade linux-image-intelUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-oem-20.04Upgrade linux-image-kvmUpgrade linux-image-5.15.0-185-generic-lpaeUpgrade linux-image-5.15.0-1116-azureUpgrade linux-image-fipsUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-fips-5.15Upgrade linux-image-5.15.0-185-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1103-kvmUpgrade linux-image-5.15.0-1052-nvidia-tegra-igx-rtUpgrade linux-image-realtimeUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-gcp-5.15Upgrade linux-image-oracleUpgrade linux-image-5.15.0-1111-gcpUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-aws-5.15Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1094-gkeopUpgrade linux-image-oem-20.04dUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-azure-cvmUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-185-generic-64kUpgrade linux-image-5.15.0-1105-raspiUpgrade linux-image-5.15.0-1108-oracleUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1107-gkeUpgrade linux-image-5.15.0-1116-azure-fipsUpgrade linux-image-5.15.0-183-lowlatency-64kUpgrade linux-image-5.15.0-1106-intel-iotg | Jul 1, 2026 | Oct 7, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub