Skip to content
Heist/ feed
Back to feed
UnratedFix available

Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete add_device_complete() runs from the hci_cmd_sync_work kworker, which holds only hci_req_sync_lock and *not* hci_dev_lock. It calls hci_conn_params_lookup() and then dereferences the returned object (params->flags) without taking hci_dev_lock: params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, le_addr_type(cp->addr.type)); ... device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, hdev->conn_flags, params ? params->flags : 0); hci_conn_params_lookup() walks hdev->le_conn_params and is documented to require hdev->lock. A concurrent MGMT_OP_REMOVE_DEVICE (remove_device()), which does run under hci_dev_lock, can call hci_conn_params_free() to list_del() and kfree() the very object the lookup returned, so the subsequent params->flags read touches freed memory [0]. Hold hci_dev_lock() across the hci_conn_params_lookup() and the read of params->flags (and the matching event emission) so the lookup result cannot be freed by a concurrent remove_device() before it is used, honouring the locking contract of hci_conn_params_lookup(). [0]: (trailing page/memory-state dump trimmed) BUG: KASAN: slab-use-after-free in add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388 CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT Hardware name: linux,dummy-virt (

Products
Kernel
Affected versions
Not specified
Fixed versions
6.12.96, 6.18.39, 6.6.145, 7.1.4
CVEs
CVE-2026-64433
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 02:02 UTC · Revision 1

Source evidence

Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

core-osv · Original source

Published 25 Jul 2026, 08:51 UTC

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete add_device_complete() runs from the hci_cmd_sync_work kworker, which holds only hci_req_sync_lock and *not* hci_dev_lock. It calls hci_conn_params_lookup() and then dereferences the returned object (params->flags) without taking hci_dev_lock: params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, le_addr_type(cp->addr.type)); ... device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, hdev->conn_flags, params ? params->flags : 0); hci_conn_params_lookup() walks hdev->le_conn_params and is documented to require hdev->lock. A concurrent MGMT_OP_REMOVE_DEVICE (remove_device()), which does run under hci_dev_lock, can call hci_conn_params_free() to list_del() and kfree() the very object the lookup returned, so the subsequent params->flags read touches freed memory [0]. Hold hci_dev_lock() across the hci_conn_params_lookup() and the read of params->flags (and the matching event emission) so the lookup result cannot be freed by a concurrent remove_device() before it is used, honouring the locking contract of hci_conn_params_lookup(). [0]: (trailing page/memory-state dump trimmed) BUG: KASAN: slab-use-after-free in add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388 CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT Hardware name: linux,dummy-virt (

osv:CVE-2026-64433

Kernel

Fixed versions: 6.6.145, 6.12.96, 6.18.39, 7.1.4

Complete source record
{
  "id": "fd468132f49d7161d76a46041944f402e7ab45c9dd4003f1f8bbfaf68a836c59",
  "url": "https://osv.dev/vulnerability/CVE-2026-64433",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete add_device_complete() runs from the hci_cmd_sync_work kworker, which holds only hci_req_sync_lock and *not* hci_dev_lock. It calls hci_conn_params_lookup() and then dereferences the returned object (params->flags) without taking hci_dev_lock: params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, le_addr_type(cp->addr.type)); ... device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, hdev->conn_flags, params ? params->flags : 0); hci_conn_params_lookup() walks hdev->le_conn_params and is documented to require hdev->lock. A concurrent MGMT_OP_REMOVE_DEVICE (remove_device()), which does run under hci_dev_lock, can call hci_conn_params_free() to list_del() and kfree() the very object the lookup returned, so the subsequent params->flags read touches freed memory [0]. Hold hci_dev_lock() across the hci_conn_params_lookup() and the read of params->flags (and the matching event emission) so the lookup result cannot be freed by a concurrent remove_device() before it is used, honouring the locking contract of hci_conn_params_lookup(). [0]: (trailing page/memory-state dump trimmed) BUG: KASAN: slab-use-after-free in add_device_complete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388 CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT Hardware name: linux,dummy-virt (",
    "evidence": "osv:CVE-2026-64433",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.6.145",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.96",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.39",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.1.4",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-64433",
      "aliases": [
        "CVE-2026-64433"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "31492b8386e5a243df26ca4a9421f6b041f414d5"
                },
                {
                  "fixed": "caed4a96d55757c139a899744657c032b6186665"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "28826a89fdfd49f3291980c2e68b8a7c5d55e199"
                },
                {
                  "fixed": "e4369e4e970f3fa4676b76be14c1d315c87f22b6"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "1e2e3044c1bc64a64aa0eaf7c17f7832c26c9775"
                },
                {
                  "fixed": "b346efa825b5e4386f19bc63f81141652d496ec4"
                },
                {
                  "fixed": "9531014c60c804e16099885d4a98aedcf31bce8d"
                },
                {
                  "fixed": "fa85d985f614bc3feb343000f14a1072e99b0df1"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.6.92"
                },
                {
                  "fixed": "6.6.145"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.12.30"
                },
                {
                  "fixed": "6.12.96"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.14.8"
                },
                {
                  "fixed": "6.15"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "7e370545b8bdb54ed7f1ae485d6d24d3b62a0b53"
                }
              ]
            }
          ],
          "versions": [
            "v6.6.144",
            "v6.6.143",
            "v6.6.142",
            "v6.6.141",
            "v6.6.140",
            "v6.6.139",
            "v6.6.138",
            "v6.6.137",
            "v6.6.136",
            "v6.6.135",
            "v6.6.134",
            "v6.6.133",
            "v6.6.132",
            "v6.6.131",
            "v6.6.130",
            "v6.6.129",
            "v6.6.128",
            "v6.6.127",
            "v6.6.126",
            "v6.6.125",
            "v6.6.124",
            "v6.6.123",
            "v6.6.122",
            "v6.6.121",
            "v6.6.120",
            "v6.6.119",
            "v6.6.118",
            "v6.6.117",
            "v6.6.116",
            "v6.6.115",
            "v6.6.114",
            "v6.6.113",
            "v6.6.112",
            "v6.6.111",
            "v6.6.110",
            "v6.6.109",
            "v6.6.108",
            "v6.6.107",
            "v6.6.106",
            "v6.6.105",
            "v6.6.104",
            "v6.6.103",
            "v6.6.102",
            "v6.6.101",
            "v6.6.100",
            "v6.6.99",
            "v6.6.98",
            "v6.6.97",
            "v6.6.96",
            "v6.6.95",
            "v6.6.94",
            "v6.6.93",
            "v6.6.92",
            "v6.12.95",
            "v6.12.94",
            "v6.12.93",
            "v6.12.92",
            "v6.12.91",
            "v6.12.90",
            "v6.12.89",
            "v6.12.88",
            "v6.12.87",
            "v6.12.86",
            "v6.12.85",
            "v6.12.84",
            "v6.12.83",
            "v6.12.82",
            "v6.12.81",
            "v6.12.80",
            "v6.12.79",
            "v6.12.78",
            "v6.12.77",
            "v6.12.76",
            "v6.12.75",
            "v6.12.74",
            "v6.12.73",
            "v6.12.72",
            "v6.12.71",
            "v6.12.70",
            "v6.12.69",
            "v6.12.68",
            "v6.12.67",
            "v6.12.66",
            "v6.12.65",
            "v6.12.64",
            "v6.12.63",
            "v6.12.62",
            "v6.12.61",
            "v6.12.60",
            "v6.12.59",
            "v6.12.58",
            "v6.12.57",
            "v6.12.56",
            "v6.12.55",
            "v6.12.54",
            "v6.12.53",
            "v6.12.52",
            "v6.12.51",
            "v6.12.50",
            "v6.12.49",
            "v6.12.48",
            "v6.12.47",
            "v6.12.46",
            "v6.12.45",
            "v6.12.44",
            "v6.12.43",
            "v6.12.42",
            "v6.12.41",
            "v6.12.40",
            "v6.12.39",
            "v6.12.38",
            "v6.12.37",
            "v6.12.36",
            "v6.12.35",
            "v6.12.34",
            "v6.12.33",
            "v6.12.32",
            "v6.12.31",
            "v6.12.30",
            "v6.14.11",
            "v6.14.10",
            "v6.14.9",
            "v6.14.8"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64433.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.6.145"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.96"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.39"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.15.0"
                },
                {
                  "fixed": "7.1.4"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64433.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.583548505Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/9531014c60c804e16099885d4a98aedcf31bce8d",
        "https://git.kernel.org/stable/c/b346efa825b5e4386f19bc63f81141652d496ec4",
        "https://git.kernel.org/stable/c/caed4a96d55757c139a899744657c032b6186665",
        "https://git.kernel.org/stable/c/e4369e4e970f3fa4676b76be14c1d315c87f22b6",
        "https://git.kernel.org/stable/c/fa85d985f614bc3feb343000f14a1072e99b0df1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64433.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-64433",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64433.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-64433",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 491764,
  "published_at": "2026-07-25T08:51:08.432+00:00"
}