Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and
CVE-2026-46275
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-46275
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"lessThan": "78aad93e938f013d9272fe0ee168f27883afa95c",
"versionType": "git"
},
{
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"lessThan": "e2d19969c8d9198ecc3090bcd5312ecd503a3339",
"versionType": "git"
},
{
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"lessThan": "c85cff648a2bc92322912db5f1727ad05afae7b6",
"versionType": "git"
},
{
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"lessThan": "9d20d48be2c4a071fb015eb09bda2cecd25daf34",
"versionType": "git"
},
{
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"lessThan": "81c7a3c22a0f2808cf4ae0b4908f59763b23606d",
"versionType": "git"
},
{
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"lessThan": "192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",
"versionType": "git"
},
{
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"lessThan": "7338031946bd06f6dff149e67b60c4cd083bfea8",
"versionType": "git"
},
{
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"lessThan": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",
"versionType": "git"
},
{
"status": "affected",
"version": "cd27019bc149f20f12ebec943c2b4c775745a5a0",
"versionType": "git"
},
{
"status": "affected",
"version": "aea63181b6fcb6b9ccde1ada9ea51be19c4015af",
"versionType": "git"
},
{
"status": "affected",
"version": "0d234d1135dcd8876de0576dac68efd0a87eef87",
"versionType": "git"
},
{
"status": "affected",
"version": "3fe978892ab46efc2f3830d9abc015eff72caaf9",
"versionType": "git"
},
{
"status": "affected",
"version": "0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f",
"versionType": "git"
},
{
"status": "affected",
"version": "4.14.203",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.153",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.73",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.8.17",
"lessThan": "5.9",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.9.2",
"lessThan": "5.10",
"versionType": "semver"
}
],
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.10",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-46275
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40168 · Revision 1
- Added to Heist Feed
- Publisher date