CVE-2025-68304

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: lookup hci_conn on RX path on protocol side

The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't

ensure hci_conn* is not concurrently modified/deleted. This locking

appears to be leftover from before conn_hash started using RCU

commit bf4c63252490b ("Bluetooth: convert conn hash to RCU")

and not clear if it had purpose since then.

Currently, there are code paths that delete hci_conn* from elsewhere

than the ordered hdev->workqueue where the RX work runs in. E.g.

commit 5af1f84ed13a ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync")

introduced some of these, and there probably were a few others before

it. It's better to do the locking so that even if these run

concurrently no UAF is possible.

Move the lookup of hci_conn and associated socket-specific conn to

protocol recv handlers, and do them within a single critical section

to cover hci_conn* usage and lookup.

syzkaller

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References