CVE-2026-80692: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
Published Aug 28, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcisync: hold conn in hciconnectacl/lesync() callbacks
There is theoretical UAF if the conn is freed while the hcisync task is running.
Hold refcount to avoid that.
Affected Software
1 affected component
Linux Linux kernel
Event History
Aug 28, 2026
CVE Published
via MITRE·06:52 AM
Data Sourced
via MITRE·06:52 AM
Description
Frequently Asked Questions
1
What condition is required for the use-after-free to occur?
The Bluetooth connection object must be freed while an hci_sync task is still running in the hci_connect_acl or hci_connect_le callback path. The issue is described as theoretical.
2
What component is affected?
The issue is in the Linux kernel Bluetooth subsystem, specifically the hci_sync handling associated with ACL and LE connection callbacks.
3
What does the fix change?
The fix holds a reference to the connection object while the relevant hci_sync callbacks execute, preventing the object from being freed during task execution.