Cloudanix VulnDB

CVE-2026-80762

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's Bluetooth handling can let a program on the same machine corrupt memory when the computer goes to sleep, potentially crashing the system or allowing an attacker to gain more control.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in hci_update_event_filter_sync() during suspend: the function walks hdev->accept_list under req_lock while a concurrent remove_device() under hdev->lock can delete and free the current list entry; subsequent dereference of the freed list.next pointer triggers the bug.

Why it matters to the business

Kernel memory corruption on Linux Bluetooth devices during system suspend can cause crashes, denial of service, or potential local privilege escalation; widespread impact on any system using the affected hci_sync paths.

How an attack unfolds

A local attacker opens an HCI socket and issues add/remove device commands while simultaneously forcing suspend (e.g., via power management or vhci), racing the two locks so that remove_device frees an accept-list node that hci_update_event_filter_sync is about to dereference after the controller wait.

How to fix it

Apply the upstream patch that snapshots the remote-wakeup addresses under hdev->lock, releases the lock before HCI commands, clears the event filter first, and skips unnecessary traversals when the list is empty.

How to confirm the fix worked

Confirm the fix by inspecting the hci_suspend_sync and hci_update_event_filter_sync functions for the snapshot-and-release pattern; run KASAN-enabled kernels through suspend/resume cycles with concurrent HCI socket activity and verify absence of use-after-free reports.

Typical attack path

  1. Open HCI raw socket and send HCI commands that add remote-wakeup devices to the accept list
  2. Trigger system suspend (or vhci_suspend_work) while holding the necessary locks
  3. Concurrently issue remove_device via another HCI socket to free the list entry under hdev->lock
  4. hci_update_event_filter_sync resumes after the HCI command wait and reads the now-freed list.next pointer
  5. Kernel oops or exploitable slab use-after-free occurs

How to detect it

Search kernel logs and crash dumps for KASAN reports referencing hci_suspend_sync+0x835, hci_update_event_filter_sync, or slab-use-after-free on accept-list entries; correlate with HCI socket activity and suspend workqueues around the time of the crash.

  • BUG: KASAN: slab-use-after-free in hci_suspend_sync
  • Read of size 8 at addr .* by task kworker.*vhci_suspend_work
  • hci_suspend_sync+0x835/0x910
  • list_del.*remove_device
  • Allocated by task.*hci_bdaddr_list_add_with_flags

What your security team should do

  • Prioritize kernel updates containing the hci_sync accept-list fix for all Linux Bluetooth hosts
  • Enable KASAN or similar memory debugging in test environments to validate the patch
  • Restrict unprivileged access to HCI sockets (CAP_NET_ADMIN) until patches are deployed
  • Monitor for kernel oops in hci_suspend_sync or vhci_suspend_work as immediate indicators

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix accept list UAF during suspend hci_update_event_filter_sync() walks hdev->accept_list while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev->req_lock, but accept-list updates are serialized by hdev->lock. Consequently, remove_device() can free the current list entry during the controller wait. The following interleaving causes the use-after-free: hci_update_event_filter_sync() remove_device() fetch accept-list entry hci_set_event_filter_sync() wait for controller response hci_dev_lock() list_del() kfree() hci_dev_unlock() read the freed list.next KASAN reported: BUG: KASAN: slab-use-after-free in hci_suspend_sync+0x835/0x910 Read of size 8 at addr ffff88810bec8440 by task kworker/0:1/10 Workqueue: events vhci_suspend_work Call Trace: hci_suspend_sync+0x835/0x910 hci_suspend_dev+0x182/0x450 process_one_work+0x661/0x1090 worker_thread+0x45b/0xd10 Allocated by task 86: hci_bdaddr_list_add_with_flags+0x1a8/0x400 add_device+0x381/0x820 hci_sock_sendmsg+0x1033/0x1ea0 Freed by task 91: kfree+0x131/0x3c0 remove_device+0x429/0xb70 hci_sock_sendmsg+0x1033/0x1ea0 Snapshot the remote-wakeup addresses under hdev->lock. Release the lock before sending HCI commands. Clear the controller event filter before building the snapshot, and skip allocation and the second list traversal when there are no matching entries. This preserves the original filter and scan-state updates without retaining an accept-list node across a controller wait.

Affected packages

Ecosystem Package Introduced Fixed