CVE-2026-80692

What it actually does

Use-after-free in Linux kernel Bluetooth hci_sync task when conn object is freed during hci_connect_acl/le_sync callbacks, allowing potential memory corruption.

Why it matters to the business

Remote attackers could compromise Linux systems using Bluetooth, leading to full system takeover or denial of service with moderate urgency given low exploit likelihood.

How an attack unfolds

An attacker initiates a Bluetooth connection to trigger the hci_sync path, then attempts to free the conn structure while the asynchronous task holds a reference, exploiting the theoretical race to corrupt kernel memory.

How to fix it

Update to a kernel version containing the referenced fix for holding refcount on conn in hci_sync callbacks; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm kernel source includes the refcount hold in hci_connect_acl/le_sync paths and test Bluetooth connection flows under memory pressure to ensure no UAF occurs.

Typical attack path

1. Establish Bluetooth adjacency or connection to target device
2. Trigger hci_connect_acl or le_sync callback via crafted packets
3. Race condition to free conn object during hci_sync task execution
4. Leverage resulting UAF for memory corruption or code execution

How to detect it

Review kernel logs for Bluetooth HCI crashes or warnings around conn handling during connection events; correlate with unusual memory access patterns in kernel traces.

What your security team should do

• Prioritize kernel updates on systems with Bluetooth enabled
• Monitor EPSS and KEV status for any increase in activity
• Disable Bluetooth where not required as a temporary control