CVE-2026-46275

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer

Dereference (NPD) conditions were observed in the lifecycle management

of hci_uart.

The primary issue arises because the workqueues (init_ready and

write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY

flag is set during TTY close. If a hangup occurs before setup completes,

hci_uart_tty_close() skips the teardown of these workqueues and

proceeds to free the `hu` struct. When the scheduled work executes

later, it blindly dereferences the freed `hu` struct.

Furthermore, several data races and UAFs were identified in the teardown

sequence:

1. Calling hci_uart_flush() from hci_uart_close() without effectively

disabling write_work causes a race condition where both can concurrently

double-free hu->tx_skb. This happens because protocol timers can

concurrently inv

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References