CVE-2026-80692: Linux Kernel Bluetooth Use-After-Free Flaw

CVE-2026-80692 Overview

CVE-2026-80692 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the hci_sync code path. The flaw exists in the hci_connect_acl and hci_connect_le_sync callbacks, where a connection object (conn) can be freed while an hci_sync task is still referencing it. Without a proper reference count hold, the kernel may access freed memory, leading to memory corruption. The fix adds a refcount hold on the connection object across the callback lifetime.

Critical Impact
An adjacent-network attacker within Bluetooth range can trigger the race condition to corrupt kernel memory, potentially achieving code execution or a full system compromise.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_sync.c)
Distributions shipping vulnerable kernel versions prior to the stable patches 2f5d635 and 9a77f296
Any system with Bluetooth hardware enabled and the vulnerable HCI connection logic

Discovery Timeline

2026-08-28 - CVE-2026-80692 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80692

Vulnerability Analysis

The vulnerability resides in the Linux kernel Bluetooth Host Controller Interface (HCI) synchronization logic. The hci_connect_acl and hci_connect_le_sync functions schedule asynchronous work through the hci_sync task to establish Asynchronous Connection-Less (ACL) and Low Energy (LE) links. These callbacks operate on a connection object represented by struct hci_conn.

The defect is a classic use-after-free race. The hci_sync task can execute after the connection object has already been released elsewhere in the stack, for example if the connection is torn down before the deferred work runs. The callback then dereferences a stale pointer to the freed hci_conn structure.

Because the freed memory can be reallocated with attacker-influenced content, a successful race can lead to arbitrary kernel-mode read, write, or control-flow hijack. The attack surface is reachable over Bluetooth radio proximity rather than the local network.

Root Cause

The root cause is missing reference counting on the hci_conn object across the asynchronous callback boundary. The hci_sync task did not hold a refcount on the connection, so nothing prevented parallel code paths from freeing the object while the callback still held a pointer to it.

Attack Vector

Exploitation requires the attacker to be within Bluetooth radio range of a vulnerable host. The attacker induces connection state transitions, such as initiating and quickly aborting ACL or LE connections, to force the race window between the hci_sync task execution and connection teardown. No authentication or user interaction is required.

The vulnerability is described as theoretical in the upstream commit message, and no verified public exploit code is available at the time of publication. See the Kernel Patch 2f5d635 and Kernel Patch 9a77f296 for the exact code changes that introduce the missing hci_conn_get/hci_conn_put pair.

Detection Methods for CVE-2026-80692

Indicators of Compromise

Kernel oops or panic messages referencing hci_connect_acl, hci_connect_le_sync, or hci_sync on the call stack
KASAN reports flagging use-after-free reads or writes in net/bluetooth/hci_sync.c
Unexpected Bluetooth stack crashes coinciding with rapid connect/disconnect activity from nearby devices

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to surface the use-after-free during Bluetooth fuzzing or normal use
Monitor kernel logs (dmesg, journalctl -k) for Bluetooth subsystem stack traces and slab corruption warnings
Correlate host telemetry with proximity events, such as sudden appearance of unknown Bluetooth peers preceding a crash

Monitoring Recommendations

Ship kernel crash and oops data to a central log platform for cross-fleet correlation
Track running kernel versions across the estate and flag hosts still on unpatched builds
Alert on repeated Bluetooth HCI errors from endpoints in shared or public spaces

How to Mitigate CVE-2026-80692

Immediate Actions Required

Apply the upstream stable kernel patches 2f5d635 and 9a77f296 as soon as your distribution ships them
Inventory hosts with Bluetooth hardware enabled and prioritize patching mobile, laptop, and IoT endpoints
Disable Bluetooth on servers and appliances that do not require it until patched kernels are deployed

Patch Information

The fix adds an explicit reference count hold on the hci_conn object inside the hci_connect_acl and hci_connect_le_sync callbacks, preventing the object from being freed while the hci_sync task is running. The change is available in the upstream stable tree via commits 2f5d635 and 9a77f296. Distribution vendors will backport these commits into supported kernel branches.

Workarounds

Unload the Bluetooth kernel modules where feasible: rmmod btusb bluetooth
Disable the Bluetooth service at boot: systemctl disable --now bluetooth.service
Restrict physical and radio proximity to sensitive hosts, such as by placing them in RF-shielded enclosures
Blocklist Bluetooth modules in /etc/modprobe.d/ to prevent inadvertent reload

bash

# Configuration example
# Disable Bluetooth stack until patched kernel is deployed
sudo systemctl disable --now bluetooth.service
echo 'blacklist btusb' | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo 'blacklist bluetooth' | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo rmmod btusb bluetooth 2>/dev/null

# Verify current kernel version and confirm patch level after update
uname -r
dmesg | grep -i bluetooth