CVE-2026-53072: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53072 Overview

CVE-2026-53072 is a locking flaw in the Linux kernel Bluetooth subsystem that can lead to a use-after-free (UAF) condition. The defect resides in hci_conn_request_evt(), which handles incoming HCI connection requests. When a protocol sets the HCI_PROTO_DEFER flag, the function calls hci_connect_cfm(conn) without holding hdev->lock. If the conn object is deleted concurrently on another CPU, the connection confirmation path operates on freed memory.

Only SCO (Synchronous Connection-Oriented) and ISO transports set HCI_PROTO_DEFER, and only for deferred setup listening sockets. The upstream fix acquires hdev->lock before invoking the confirmation callback.

Critical Impact
A local attacker with access to Bluetooth functionality can trigger a race condition that frees a connection object while it is still referenced, potentially leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel — Bluetooth subsystem (net/bluetooth/hci_event.c)
Systems with SCO or ISO Bluetooth transport enabled
Distributions shipping affected stable kernels prior to the referenced fix commits

Discovery Timeline

2026-06-24 - CVE-2026-53072 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53072

Vulnerability Analysis

The Linux kernel Bluetooth Host Controller Interface (HCI) layer processes incoming connection requests through hci_conn_request_evt(). When a higher-layer protocol enables deferred setup via the HCI_PROTO_DEFER flag, the event handler invokes hci_connect_cfm(conn) outside the protection of hdev->lock. The hci_connect_cfm() function assumes the device lock is held by its callers.

If another kernel context deletes the conn structure while hci_connect_cfm() is dereferencing it, the resulting use-after-free condition occurs on kernel heap memory. The vulnerability is classified as a [CWE-416] Use After Free arising from a [CWE-667] Improper Locking defect.

Root Cause

The non-deferred listening socket paths consistently invoke hci_connect_cfm() while holding hdev->lock. The deferred path through HCI_PROTO_DEFER failed to maintain this invariant, breaking the locking contract. Because HCI_EV_CONN_REQUEST is not generated for ISO transport, only SCO defer-setup listeners reach this code path in practice.

Attack Vector

Exploitation requires the ability to initiate Bluetooth connections to a target device with SCO defer-setup listening sockets active. A local user or a Bluetooth-range attacker can race a connection request against a concurrent connection teardown to free the conn object. Reliable exploitation depends on winning the race window between the unprotected callback and the deletion path. Successful exploitation may yield kernel memory corruption, information disclosure, or denial of service.

No public proof-of-concept code has been released for this issue. See the kernel patch commits for technical implementation details.

Detection Methods for CVE-2026-53072

Indicators of Compromise

Kernel oops or panic messages referencing hci_connect_cfm, hci_conn_request_evt, or hci_event.c in dmesg output
KASAN reports indicating use-after-free in the Bluetooth subsystem on systems with KASAN-enabled kernels
Unexpected Bluetooth daemon crashes (bluetoothd) coinciding with SCO connection activity

Detection Strategies

Audit running kernel versions against the fixed commits (385b2d0, 541d5bf, 5c7209a, 60e3f4f, 6b4d226, 9d4a6c0, c27224d, c7777f5) to confirm patch status.
Monitor kernel ring buffer logs for stack traces involving Bluetooth HCI event handling.
Correlate Bluetooth pairing or SCO setup activity with subsequent kernel instability across the fleet.

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized logging platform for anomaly review.
Track Bluetooth interface enable and disable events on endpoints, particularly servers where Bluetooth is non-essential.
Alert on repeated kernel warnings or BUG messages in the net/bluetooth/ code path.

How to Mitigate CVE-2026-53072

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the Kernel Patch Commit 385b2d0 and the related stable backports.
Update to a distribution kernel package that includes the locking fix for hci_conn_request_evt().
Disable the Bluetooth stack on systems that do not require it, especially servers and infrastructure hosts.

Patch Information

The fix holds hdev->lock around the hci_connect_cfm(conn) call in the HCI_PROTO_DEFER path. Stable backports are available across multiple kernel series. Refer to the following commits: 385b2d0, 541d5bf, 5c7209a, 60e3f4f, 6b4d226, 9d4a6c0, c27224d, and c7777f5.

Workarounds

Unload the Bluetooth kernel modules (bluetooth, btusb) on hosts that do not require Bluetooth connectivity.
Block loading of the Bluetooth module via /etc/modprobe.d/ configuration on production servers.
Restrict physical proximity and pairing privileges where Bluetooth must remain enabled.

bash

# Disable and blacklist the Bluetooth kernel modules
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service

cat <<EOF | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
blacklist bluetooth
blacklist btusb
blacklist bnep
blacklist btintel
EOF

sudo rmmod btusb bluetooth 2>/dev/null || true

# Verify the running kernel includes the fix commit
uname -r
dmesg | grep -i bluetooth