CVE-2026-64433

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

add_device_complete() runs from the hci_cmd_sync_work kworker, which

holds only hci_req_sync_lock and *not* hci_dev_lock. It calls

hci_conn_params_lookup() and then dereferences the returned object

(params->flags) without taking hci_dev_lock:

params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,

le_addr_type(cp->addr.type));

...

device_flags_changed(NULL, hdev, &cp->addr.bdaddr,

cp->addr.type, hdev->conn_flags,

params ? params->flags : 0);

hci_conn_params_lookup() walks hdev->le_conn_params and is documented to

require hdev->lock. A concurrent MGMT_OP_REMOVE_DEVICE

(remove_device()), which does run under hci_dev_lock, can call

hci_conn_params_free() to list_del() and kfree() the very object the

lookup returned, so the subsequent params->flags read touches freed

memory [0].

Hold hci_dev_lock() across the hci_conn_params_l

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References