CVE-2026-46111

What it actually does

This is a Linux kernel Bluetooth use-after-free vulnerability in the HCI connection handling path for BIG synchronization. A stale hci_conn object can be dereferenced across an asynchronous create_big_sync/create_big_complete boundary after the connection has already been deleted, potentially leading to kernel memory corruption. With local, low-privileged access and access to the Bluetooth subsystem, an attacker may be able to trigger a kernel crash or potentially execute code in kernel context, resulting in confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation could allow a local attacker to crash affected Linux systems or potentially gain elevated privileges, creating risk to workstation, server, embedded, and appliance deployments where Bluetooth support is enabled. The vulnerability is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score, but the CVSS 7.8 rating means organizations should still prioritize patching systems that expose Bluetooth functionality or allow untrusted local users.

How an attack unfolds

An attacker first obtains local access to an affected Linux system with enough permission to interact with Bluetooth interfaces or related kernel paths. They then trigger Bluetooth HCI connection lifecycle activity involving BIG synchronization while racing or sequencing connection teardown so that the kernel queues asynchronous work using a connection pointer that later becomes stale. When the completion handler runs, vulnerable kernels may dereference the freed connection object on an error path, causing use-after-free behavior. Depending on kernel build, memory layout, hardening, and attacker control over freed memory reuse, this may result in a denial-of-service kernel panic or, in a more advanced scenario, privilege escalation through kernel memory corruption.

How to fix it

Upgrade to a vendor-supported Linux kernel that includes the Bluetooth hci_conn create_big_sync use-after-free fix. Because no exact fixed versions were provided, consult the Linux distribution, appliance vendor, or kernel stable branch advisories for the first release containing the patch that adds hci_conn_valid() checks, holds an hci_conn_get() reference while queueing create_big_sync(), and revalidates the connection under hci_dev_lock() in the completion path. If immediate patching is not possible, reduce exposure by disabling Bluetooth where it is not required, unloading or blocking Bluetooth kernel modules where operationally safe, restricting local shell access to trusted users, and applying kernel hardening controls such as lockdown, module signing, SELinux/AppArmor confinement, and least-privilege device access policies.

How to confirm the fix worked

Confirm the running kernel has been updated to a distribution or vendor build that includes the fix for the Bluetooth hci_conn create_big_sync use-after-free. Validate that the system has rebooted into the patched kernel, not merely installed the package. On systems where Bluetooth is not required, confirm Bluetooth services are disabled and relevant modules are not loaded. Review vendor changelogs or kernel source/package metadata for references to the create_big_sync, create_big_complete, hci_conn_valid(), or hci_conn_get() fix. For exposure assessment, inventory systems with Bluetooth controllers, loaded bluetooth/btusb modules, enabled bluetooth.service, or users permitted to access Bluetooth management interfaces.

Typical attack path

1. Gain local, low-privileged access to an affected Linux system.
2. Confirm Bluetooth support is present and enabled, or that Bluetooth kernel modules can be reached.
3. Interact with Bluetooth HCI functionality related to connection creation and BIG synchronization.
4. Trigger connection teardown or failure conditions while asynchronous BIG creation work is pending.
5. Cause create_big_complete() to dereference a stale hci_conn pointer after hci_connect_cfm() and hci_conn_del() have freed or invalidated the object.
6. Leverage the resulting use-after-free for kernel crash or potential privilege escalation, depending on exploit reliability and system hardening.

How to detect it

Look for signs of attempted or successful local exploitation in kernel and system logs rather than network perimeter telemetry, because this is a local kernel Bluetooth vulnerability. Review dmesg, journald, /var/log/kern.log, /var/log/messages, audit logs, EDR telemetry, and crash dump infrastructure for Bluetooth-related kernel warnings, panics, KASAN reports, slab corruption, general protection faults, or call traces referencing create_big_sync(), create_big_complete(), hci_connect_cfm(), hci_conn_del(), hci_conn_hash_del(), bt_link_release(), or hci_conn_valid(). Correlate crash timing with local user sessions, suspicious execution of Bluetooth tooling, unexpected access to HCI devices, or abnormal loading of Bluetooth modules. If kernel crash dumps are available, inspect stack traces and freed-object diagnostics for hci_conn use-after-free patterns. Absence of logs does not prove absence of exploitation, because a successful local privilege escalation may leave limited artifacts unless kernel auditing or EDR captured the precursor Bluetooth interactions.

• use-after-free in create_big_complete
• create_big_sync
• create_big_complete
• hci_connect_cfm
• hci_conn_del
• hci_conn_hash_del
• bt_link_release
• hci_conn_valid
• Bluetooth: hci_conn
• KASAN: use-after-free
• BUG: KASAN: use-after-free
• general protection fault
• kernel BUG at
• Call Trace:
• bluetooth.service
• btusb
• bluetooth
• /var/log/kern.log
• /var/log/messages

What your security team should do

• Prioritize patching Linux systems with Bluetooth enabled, multi-user access, kiosk/workstation use cases, or untrusted local code execution risk.
• Inventory affected Linux kernel versions across servers, workstations, embedded devices, and appliances; include systems where Bluetooth modules are installed even if not actively used.
• Disable Bluetooth on systems that do not require it, especially production servers and privileged administrative workstations.
• Monitor kernel logs for Bluetooth-related crashes, KASAN use-after-free reports, or call traces involving create_big_sync, create_big_complete, hci_connect_cfm, or hci_conn_del.
• Restrict local user access and device permissions that allow interaction with Bluetooth HCI management interfaces.
• Ensure systems reboot into the patched kernel after update deployment and remove or deprioritize vulnerable fallback kernels where operationally acceptable.
• Because this is not currently KEV-listed and has low EPSS, treat it as important hardening rather than an emergency internet-exposed remote exploitation issue, unless local untrusted users or Bluetooth-heavy workflows are present.