GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46275 (GCVE-0-2026-46275)

Vulnerability from cvelistv5 – Published: 2026-06-08 14:30 – Updated: 2026-08-05 12:30
VLAI
Title
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 78aad93e938f013d9272fe0ee168f27883afa95c (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < e2d19969c8d9198ecc3090bcd5312ecd503a3339 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < c85cff648a2bc92322912db5f1727ad05afae7b6 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 9d20d48be2c4a071fb015eb09bda2cecd25daf34 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 81c7a3c22a0f2808cf4ae0b4908f59763b23606d (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < 7338031946bd06f6dff149e67b60c4cd083bfea8 (git)
Affected: 3b799254cf6f481460719023d7a18f46651e5e7f , < c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b (git)
Affected: cd27019bc149f20f12ebec943c2b4c775745a5a0 (git)
Affected: aea63181b6fcb6b9ccde1ada9ea51be19c4015af (git)
Affected: 0d234d1135dcd8876de0576dac68efd0a87eef87 (git)
Affected: 3fe978892ab46efc2f3830d9abc015eff72caaf9 (git)
Affected: 0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f (git)
Affected: 4.14.203 , < 4.15 (semver)
Affected: 4.19.153 , < 4.20 (semver)
Affected: 5.4.73 , < 5.5 (semver)
Affected: 5.8.17 , < 5.9 (semver)
Affected: 5.9.2 , < 5.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_ldisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78aad93e938f013d9272fe0ee168f27883afa95c",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "e2d19969c8d9198ecc3090bcd5312ecd503a3339",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "c85cff648a2bc92322912db5f1727ad05afae7b6",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "9d20d48be2c4a071fb015eb09bda2cecd25daf34",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "81c7a3c22a0f2808cf4ae0b4908f59763b23606d",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "7338031946bd06f6dff149e67b60c4cd083bfea8",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "lessThan": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",
              "status": "affected",
              "version": "3b799254cf6f481460719023d7a18f46651e5e7f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cd27019bc149f20f12ebec943c2b4c775745a5a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aea63181b6fcb6b9ccde1ada9ea51be19c4015af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d234d1135dcd8876de0576dac68efd0a87eef87",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fe978892ab46efc2f3830d9abc015eff72caaf9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.153",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.73",
              "versionType": "semver"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10",
              "status": "affected",
              "version": "5.9.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_ldisc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.153",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.73",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.9.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n\nVulnerabilities leading to Use-After-Free (UAF) and Null Pointer\nDereference (NPD) conditions were observed in the lifecycle management\nof hci_uart.\n\nThe primary issue arises because the workqueues (init_ready and\nwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READY\nflag is set during TTY close. If a hangup occurs before setup completes,\nhci_uart_tty_close() skips the teardown of these workqueues and\nproceeds to free the `hu` struct. When the scheduled work executes\nlater, it blindly dereferences the freed `hu` struct.\n\nFurthermore, several data races and UAFs were identified in the teardown\nsequence:\n1. Calling hci_uart_flush() from hci_uart_close() without effectively\n   disabling write_work causes a race condition where both can concurrently\n   double-free hu-\u003etx_skb. This happens because protocol timers can\n   concurrently invoke hci_uart_tx_wakeup() and requeue write_work.\n2. Calling hci_free_dev(hdev) before hu-\u003eproto-\u003eclose(hu) causes a UAF\n   when vendor specific protocol close callbacks dereference hu-\u003ehdev.\n3. In the initialization error paths, failing to take the proto_lock\n   write lock before clearing PROTO_READY leads to races with active\n   readers. Additionally, hci_uart_tty_receive() accesses hu-\u003ehdev\n   outside the read lock, leading to UAFs if the initialization error\n   path frees hdev concurrently.\n\nFix these synchronization and lifecycle issues by:\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,\n   followed immediately by a cancel_work_sync(\u0026hu-\u003ewrite_work). Clearing\n   the flag locks out concurrent protocol timers from successfully invoking\n   hci_uart_tx_wakeup(), effectively rendering the cancellation permanent\n   and preventing the tx_skb double-free.\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip\n   hu-\u003eproto-\u003eflush(). This is perfectly safe in the tty_close path\n   because hu-\u003eproto-\u003eclose() executes shortly after, which intrinsically\n   purges all protocol SKB queues and tears down the state.\n3. Relocating hu-\u003eproto-\u003eclose(hu) strictly prior to hci_free_dev(hdev)\n   across all close and error paths to prevent vendor-level UAFs.\n4. Moving the hdev-\u003estat.byte_rx increment in hci_uart_tty_receive()\n   inside the proto_lock read-side critical section to safely synchronize\n   with device unregistration.\n5. Adding cancel_work_sync(\u0026hu-\u003ewrite_work) to hci_uart_close() to safely\n   flush the workqueue before hci_uart_flush() is invoked via the HCI core.\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across\n   all paths to prevent permanently breaking user-space retry capabilities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local TTY control (TIOCSETD to N_HCI, HCIUARTSETPROTO ioctl, hangup/close) gated by CAP_NET_ADMIN at hci_uart_tty_open(); the bugs are in driver lifecycle teardown, not in processing of remote Bluetooth over-the-air packets.\nAC:L - The attacker controls both sides of every race by concurrently opening/closing the TTY line discipline, issuing HCIUART ioctls, and timing hangup against in-flight workqueues and protocol timers; UAF conditions are reliably winnable without luck-dependent memory layout.\nPR:L - hci_uart_tty_open() explicitly requires CAP_NET_ADMIN, and adapter teardown paths are similarly admin-gated; CAP_NET_ADMIN is obtainable by an unprivileged user inside a user namespace, satisfying the Low privileges threshold rather than High.\nUI:N - Once the attacker has the required local TTY/HCI access, triggering the UAF or double-free races requires no action from a separate victim user.\nS:U - The vulnerability corrupts kernel heap memory within the kernel\u0027s own security boundary; successful exploitation yields kernel privilege escalation, not a cross-boundary escape such as VM or sandbox breakout.\nC:H - Multiple use-after-free conditions on the hci_uart and hci_dev structures allow dereferencing attacker-influenced freed memory, providing a standard kernel info-leak primitive consistent with UAF severity guidance.\nI:H - The UAF and hu-\u003etx_skb double-free races enable control of freed slab objects and heap grooming, providing a path to arbitrary kernel memory corruption and potential code execution in kernel context.\nA:H - Use-after-free and double-free in kernel workqueue and teardown paths reliably cause kernel oops or panic, and can be triggered repeatedly to deny availability of the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:58.918Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339"
        },
        {
          "url": "https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34"
        },
        {
          "url": "https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d"
        },
        {
          "url": "https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894"
        },
        {
          "url": "https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b"
        }
      ],
      "title": "Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46275",
    "datePublished": "2026-06-08T14:30:54.232Z",
    "dateReserved": "2026-05-13T15:03:33.109Z",
    "dateUpdated": "2026-08-05T12:30:58.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46275",
      "date": "2026-09-16",
      "epss": "0.00186",
      "percentile": "0.08455"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:57:02.000Z",
      "cve": "CVE-2026-46275",
      "id": "msrc_CVE-2026-46275",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46275.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46275\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-08T16:16:40.863\",\"lastModified\":\"2026-07-23T07:10:00.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_uart: fix UAFs and race conditions in close and init paths\\n\\nVulnerabilities leading to Use-After-Free (UAF) and Null Pointer\\nDereference (NPD) conditions were observed in the lifecycle management\\nof hci_uart.\\n\\nThe primary issue arises because the workqueues (init_ready and\\nwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READY\\nflag is set during TTY close. If a hangup occurs before setup completes,\\nhci_uart_tty_close() skips the teardown of these workqueues and\\nproceeds to free the `hu` struct. When the scheduled work executes\\nlater, it blindly dereferences the freed `hu` struct.\\n\\nFurthermore, several data races and UAFs were identified in the teardown\\nsequence:\\n1. Calling hci_uart_flush() from hci_uart_close() without effectively\\n   disabling write_work causes a race condition where both can concurrently\\n   double-free hu-\u003etx_skb. This happens because protocol timers can\\n   concurrently invoke hci_uart_tx_wakeup() and requeue write_work.\\n2. Calling hci_free_dev(hdev) before hu-\u003eproto-\u003eclose(hu) causes a UAF\\n   when vendor specific protocol close callbacks dereference hu-\u003ehdev.\\n3. In the initialization error paths, failing to take the proto_lock\\n   write lock before clearing PROTO_READY leads to races with active\\n   readers. Additionally, hci_uart_tty_receive() accesses hu-\u003ehdev\\n   outside the read lock, leading to UAFs if the initialization error\\n   path frees hdev concurrently.\\n\\nFix these synchronization and lifecycle issues by:\\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,\\n   followed immediately by a cancel_work_sync(\u0026hu-\u003ewrite_work). Clearing\\n   the flag locks out concurrent protocol timers from successfully invoking\\n   hci_uart_tx_wakeup(), effectively rendering the cancellation permanent\\n   and preventing the tx_skb double-free.\\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip\\n   hu-\u003eproto-\u003eflush(). This is perfectly safe in the tty_close path\\n   because hu-\u003eproto-\u003eclose() executes shortly after, which intrinsically\\n   purges all protocol SKB queues and tears down the state.\\n3. Relocating hu-\u003eproto-\u003eclose(hu) strictly prior to hci_free_dev(hdev)\\n   across all close and error paths to prevent vendor-level UAFs.\\n4. Moving the hdev-\u003estat.byte_rx increment in hci_uart_tty_receive()\\n   inside the proto_lock read-side critical section to safely synchronize\\n   with device unregistration.\\n5. Adding cancel_work_sync(\u0026hu-\u003ewrite_work) to hci_uart_close() to safely\\n   flush the workqueue before hci_uart_flush() is invoked via the HCI core.\\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across\\n   all paths to prevent permanently breaking user-space retry capabilities.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nBluetooth: hci_uart: corrige UAFs y condiciones de carrera en las rutas de cierre e inicializaci\u00f3n\\n\\nSe observaron vulnerabilidades que conducen a condiciones de Uso Despu\u00e9s de Liberaci\u00f3n (UAF) y Desreferencia de Puntero Nulo (NPD) en la gesti\u00f3n del ciclo de vida de hci_uart.\\n\\nEl problema principal surge porque las colas de trabajo (workqueues) (init_ready y write_work) solo se vac\u00edan/cancelan si la bandera HCI_UART_PROTO_READY est\u00e1 establecida durante el cierre de TTY. Si ocurre un cuelgue antes de que se complete la configuraci\u00f3n, hci_uart_tty_close() omite la desinstalaci\u00f3n de estas colas de trabajo y procede a liberar la estructura \u0027hu\u0027. Cuando el trabajo programado se ejecuta m\u00e1s tarde, desreferencia ciegamente la estructura \u0027hu\u0027 liberada.\\n\\nAdem\u00e1s, se identificaron varias condiciones de carrera de datos y UAFs en la secuencia de desinstalaci\u00f3n:\\n1. Llamar a hci_uart_flush() desde hci_uart_close() sin deshabilitar efectivamente write_work causa una condici\u00f3n de carrera donde ambos pueden liberar doblemente hu-\u003etx_skb de forma concurrente. Esto sucede porque los temporizadores del protocolo pueden invocar concurrentemente hci_uart_tx_wakeup() y volver a encolar write_work.\\n2. Llamar a hci_free_dev(hdev) antes de hu-\u003eproto-\u003eclose(hu) causa un UAF cuando las devoluciones de llamada de cierre del protocolo espec\u00edfico del proveedor desreferencian hu-\u003ehdev.\\n3. En las rutas de error de inicializaci\u00f3n, no tomar el bloqueo de escritura proto_lock antes de borrar PROTO_READY conduce a condiciones de carrera con lectores activos. Adem\u00e1s, hci_uart_tty_receive() accede a hu-\u003ehdev fuera del bloqueo de lectura, lo que lleva a UAFs si la ruta de error de inicializaci\u00f3n libera hdev concurrentemente.\\n\\nCorregir estos problemas de sincronizaci\u00f3n y ciclo de vida mediante:\\n1. Reordenar hci_uart_tty_close() para borrar HCI_UART_PROTO_READY primero, seguido inmediatamente por un cancel_work_sync(\u0026hu-\u003ewrite_work). Borrar la bandera bloquea a los temporizadores del protocolo concurrentes para que no invoquen con \u00e9xito hci_uart_tx_wakeup(), haciendo que la cancelaci\u00f3n sea permanente y evitando la doble liberaci\u00f3n de tx_skb.\\n2. Nota: Borrar PROTO_READY temprano hace que hci_uart_close() omita hu-\u003eproto-\u003eflush(). Esto es perfectamente seguro en la ruta tty_close porque hu-\u003eproto-\u003eclose() se ejecuta poco despu\u00e9s, lo que intr\u00ednsecamente purga todas las colas SKB del protocolo y desinstala el estado.\\n3. Reubicar hu-\u003eproto-\u003eclose(hu) estrictamente antes de hci_free_dev(hdev) en todas las rutas de cierre y error para prevenir UAFs a nivel de proveedor.\\n4. Mover el incremento de hdev-\u003estat.byte_rx en hci_uart_tty_receive() dentro de la secci\u00f3n cr\u00edtica del lado de lectura de proto_lock para sincronizar de forma segura con la anulaci\u00f3n del registro del dispositivo.\\n5. A\u00f1adir cancel_work_sync(\u0026hu-\u003ewrite_work) a hci_uart_close() para vaciar de forma segura la cola de trabajo antes de que hci_uart_flush() sea invocado a trav\u00e9s del n\u00facleo HCI.\\n6. Utilizar cancel_work_sync() en lugar de disable_work_sync() en todas las rutas para evitar romper permanentemente las capacidades de reintento del espacio de usuario.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/bluetooth/hci_ldisc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3b799254cf6f481460719023d7a18f46651e5e7f\",\"lessThan\":\"78aad93e938f013d9272fe0ee168f27883afa95c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b799254cf6f481460719023d7a18f46651e5e7f\",\"lessThan\":\"e2d19969c8d9198ecc3090bcd5312ecd503a3339\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b799254cf6f481460719023d7a18f46651e5e7f\",\"lessThan\":\"c85cff648a2bc92322912db5f1727ad05afae7b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b799254cf6f481460719023d7a18f46651e5e7f\",\"lessThan\":\"9d20d48be2c4a071fb015eb09bda2cecd25daf34\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b799254cf6f481460719023d7a18f46651e5e7f\",\"lessThan\":\"81c7a3c22a0f2808cf4ae0b4908f59763b23606d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b799254cf6f481460719023d7a18f46651e5e7f\",\"lessThan\":\"192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b799254cf6f481460719023d7a18f46651e5e7f\",\"lessThan\":\"7338031946bd06f6dff149e67b60c4cd083bfea8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b799254cf6f481460719023d7a18f46651e5e7f\",\"lessThan\":\"c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cd27019bc149f20f12ebec943c2b4c775745a5a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aea63181b6fcb6b9ccde1ada9ea51be19c4015af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0d234d1135dcd8876de0576dac68efd0a87eef87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fe978892ab46efc2f3830d9abc015eff72caaf9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.14.203\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.153\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.73\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.8.17\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.9.2\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/bluetooth/hci_ldisc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.258\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.142\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.203\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"27A7D190-0093-49D0-BC13-C06D04205CB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.153\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"F9F8E966-D84B-4A94-8A67-E1B47A05557F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.73\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"886AB560-B760-44F0-AD89-3F275E4C0F58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8.17\",\"versionEndExcluding\":\"5.9\",\"matchCriteriaId\":\"BEFC3ACE-365D-48E7-9C0A-019C74CC0725\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9.2\",\"versionEndExcluding\":\"5.10.258\",\"matchCriteriaId\":\"38EA52EA-57DE-4180-953C-1512932A936A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.209\",\"matchCriteriaId\":\"919C10A9-7951-4A74-BADD-C135A0A8D8B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"92385813-D91D-480D-83A1-F423D2CBB2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.142\",\"matchCriteriaId\":\"FBFF77B0-526A-4AF1-84D0-ED7187624A67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.92\",\"matchCriteriaId\":\"9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.34\",\"matchCriteriaId\":\"A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.11\",\"matchCriteriaId\":\"0520D091-FC52-4A50-AF07-70AE7D08B750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:45:34+00:00",
      "cve": "CVE-2026-46275",
      "id": "CVE-2026-46275",
      "initial_release_date": "2026-06-08T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46275.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:36:39Z",
      "cve": "CVE-2026-46275",
      "id": "CVE-2026-46275",
      "initial_release_date": "2026-06-09T02:21:16Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "578",
      "product_status:known_not_affected": "82",
      "product_status:recommended": "277",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46275",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46275.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.