CVE-2026-46111: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46111 Overview

CVE-2026-46111 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_conn connection handling code. The flaw resides in the create_big_sync() function path used when creating a Broadcast Isochronous Group (BIG). When a connection becomes stale before BIG creation completes, create_big_complete() unconditionally dereferences the hci_conn pointer on error, leading to a use-after-free via hci_connect_cfm() and hci_conn_del(). The issue affects systems running vulnerable Linux kernel versions with Bluetooth support enabled.

Critical Impact
A use-after-free condition in the Bluetooth create_big_sync() path can lead to kernel memory corruption, potentially resulting in privilege escalation or denial of service on affected Linux systems.

Affected Products

Linux kernel (Bluetooth subsystem, hci_conn module)
Distributions shipping vulnerable upstream kernel versions prior to the fix
Systems with Bluetooth Low Energy (BLE) Isochronous Channels enabled

Discovery Timeline

2026-05-28 - CVE-2026-46111 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46111

Vulnerability Analysis

The vulnerability exists in the Linux kernel Bluetooth Host Controller Interface (HCI) connection management. When a Broadcast Isochronous Group (BIG) is created asynchronously, the create_big_sync() function queues work that eventually invokes create_big_complete(). If the underlying hci_conn object becomes stale before the asynchronous operation completes, the completion callback dereferences a freed pointer.

The upstream fix introduces an hci_conn_valid() check in create_big_sync() to detect stale connections before proceeding. It also handles the resulting -ECANCELED status in create_big_complete() and re-validates the connection under hci_dev_lock() before dereferencing. This pattern aligns with the existing approach used by create_le_conn_complete() and create_pa_complete().

Root Cause

The root cause is missing lifetime management of the hci_conn object across an asynchronous boundary. The original code did not take a reference on the connection when queueing create_big_sync(), allowing the object to be freed before the completion callback ran. The fix takes a reference via hci_conn_get() when queueing the work, and releases it with hci_conn_put() in the completion callback. The refcount keeps the object allocated while hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on hdev->conn_hash [CWE-416].

Attack Vector

Exploitation requires the ability to trigger BIG creation and induce a race where the hci_conn object is freed before the completion callback executes. Local attackers with access to Bluetooth interfaces or proximity-based actors capable of inducing specific HCI state transitions could potentially trigger the condition. Successful exploitation could corrupt kernel memory through dereference of a freed pointer in hci_connect_cfm() and hci_conn_del().

Verified exploitation code is not available. See the upstream commits referenced for technical patch details.

Detection Methods for CVE-2026-46111

Indicators of Compromise

Kernel oops or panic messages referencing create_big_complete, hci_connect_cfm, or hci_conn_del in dmesg or system logs
KASAN reports identifying use-after-free in the Bluetooth hci_conn subsystem
Unexpected Bluetooth daemon (bluetoothd) crashes correlated with isochronous channel activity

Detection Strategies

Audit running kernel versions against the patched commits listed in upstream stable trees
Enable kernel address sanitizer (KASAN) in test environments to surface use-after-free conditions during Bluetooth fuzzing
Monitor kernel ring buffer logs for stack traces involving create_big_sync or create_big_complete

Monitoring Recommendations

Collect and centralize kernel logs from Linux endpoints to identify oops conditions referencing the Bluetooth stack
Track Bluetooth subsystem error rates and abnormal HCI state transitions across managed Linux fleets
Inventory hosts with Bluetooth hardware and active BLE Isochronous Channel usage to prioritize patching

How to Mitigate CVE-2026-46111

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the Linux Kernel Security Commit series as soon as your distribution publishes updated packages
Reboot affected systems after kernel updates to ensure the patched code path is active
For systems where Bluetooth is not required, disable the Bluetooth service and unload the bluetooth kernel module

Patch Information

The fix has been merged across multiple Linux stable branches. Refer to the upstream commits: 0beddb0c380b, 1750a2df0eab, 6823f730bf19, dc34f8d8240f, and f8eaf92c57ad. Track your distribution's security advisories for backported builds.

Workarounds

Disable Bluetooth on systems that do not require it by stopping bluetooth.service and blacklisting the bluetooth and btusb modules
Restrict physical and local user access to systems where Bluetooth must remain enabled until patches are applied
Limit the use of BLE Isochronous Channel features on unpatched kernels where feasible

bash

# Configuration example: disable Bluetooth on unpatched Linux hosts
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo "blacklist btusb" | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo update-initramfs -u