CVE-2026-31500

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock

btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET

and Intel exception-info retrieval) without holding

hci_req_sync_lock(). This lets it race against

hci_dev_do_close() -> btintel_shutdown_combined(), which also runs

__hci_cmd_sync() under the same lock. When both paths manipulate

hdev->req_status/req_rsp concurrently, the close path may free the

response skb first, and the still-running hw_error path hits a

slab-use-after-free in kfree_skb().

Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it

is serialized with every other synchronous HCI command issuer.

Below is the data race report and the kasan report:

BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined

read of hdev->req_rsp at net/bluetooth/hci_sync.c:199

by task kworker/u17:1/83:

__hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_syn

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References