CVE-2026-80762: Linux Kernel Bluetooth Use-After-Free Flaw

CVE-2026-80762 Overview

CVE-2026-80762 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_sync code path handling suspend operations. The flaw resides in hci_update_event_filter_sync(), which walks hdev->accept_list while issuing synchronous Host Controller Interface (HCI) commands for each remote-wakeup device. Accept-list mutations are serialized by hdev->lock, but the suspend path only holds hdev->req_lock. A concurrent remove_device() call can free the current list entry while the suspend worker waits for a controller response, leading to a slab use-after-free detected by KASAN.

Critical Impact
A local attacker with the ability to trigger Bluetooth accept-list updates during suspend can cause kernel memory corruption, resulting in denial of service or potential privilege escalation.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_sync.c)
Stable branches referenced in the upstream fix commits
Distributions shipping affected kernels with Bluetooth enabled

Discovery Timeline

2026-09-04 - CVE-2026-80762 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80762

Vulnerability Analysis

The defect is a use-after-free [CWE-416] in the Bluetooth Host Controller Interface synchronization layer. During system suspend, hci_update_event_filter_sync() iterates over hdev->accept_list to program remote-wakeup filters into the controller. Each iteration invokes hci_set_event_filter_sync(), which blocks waiting for a controller acknowledgement. During this wait, the suspend path only holds hdev->req_lock, leaving hdev->lock (the lock actually protecting the accept list) unheld.

A parallel remove_device() call from a user-mode HCI socket writer acquires hdev->lock, unlinks the current list entry with list_del(), and frees it with kfree(). When the suspend worker resumes, it dereferences the freed node's next pointer to continue traversal, reading freed slab memory. The reporter reproduced the crash under a vhci_suspend_work workqueue context, with KASAN flagging the read at hci_suspend_sync+0x835/0x910.

Root Cause

The root cause is inconsistent locking. Accept-list traversal and HCI command dispatch are interleaved inside a single loop, but the accept list is protected by hdev->lock while the synchronous HCI wait is performed without that lock. This lock-scope mismatch permits list-node reclamation mid-traversal.

Attack Vector

Exploitation requires local access with the ability to send HCI socket messages that call add_device() and remove_device() while a suspend transition is in progress. Environments exposing the Bluetooth stack to untrusted local users or containers face the highest risk. The vulnerability is not remotely reachable over the air.

No public proof-of-concept exploit is documented in the enriched CVE data. The upstream commits referenced below fix the issue by snapshotting remote-wakeup addresses under hdev->lock, releasing the lock before issuing HCI commands, and skipping the second traversal entirely when no matching entries exist.

Detection Methods for CVE-2026-80762

Indicators of Compromise

KASAN reports of slab-use-after-free in hci_suspend_sync or hci_update_event_filter_sync in the kernel log.
Unexpected kernel oops or panic in vhci_suspend_work or the events workqueue referencing Bluetooth HCI functions.
Repeated calls to hci_sock_sendmsg invoking add_device and remove_device in close proximity to suspend events.

Detection Strategies

Enable KASAN on test kernels to surface use-after-free access in the Bluetooth accept-list path.
Monitor dmesg for stack traces containing hci_suspend_sync, hci_update_event_filter_sync, or hci_bdaddr_list_add_with_flags.
Audit installed kernel packages against distribution advisories that reference the upstream commits (29c59212, 87ad116a, 95bb57bc, b5181516, bb5f5414, f57b399c, fe93a697).

Monitoring Recommendations

Alert on kernel crashes on systems that suspend frequently and use Bluetooth peripherals for wake events.
Track HCI socket usage from unprivileged processes and containers that should not require raw Bluetooth access.
Aggregate kernel telemetry to identify hosts still running vulnerable kernel builds after patch rollout.

How to Mitigate CVE-2026-80762

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits as soon as vendor builds are available.
Restrict CAP_NET_ADMIN and raw HCI socket access to trusted system services only.
Disable Bluetooth (rfkill block bluetooth) on servers and systems where the radio is unnecessary.

Patch Information

The fix is distributed across several stable-tree commits, including Linux Kernel Commit 29c59212, Commit 87ad116a, Commit 95bb57bc, Commit b5181516, Commit bb5f5414, Commit f57b399c, and Commit fe93a697. The fix snapshots remote-wakeup addresses under hdev->lock, releases the lock before issuing HCI commands, clears the controller event filter before rebuilding, and skips allocation when no entries match.

Workarounds

Unload the bluetooth and btusb kernel modules on systems where Bluetooth is not required.
Prevent Bluetooth from participating in remote-wakeup by disabling wake-on-Bluetooth in BIOS/UEFI and userspace power management.
Limit which users and containers can open AF_BLUETOOTH sockets through seccomp or namespace restrictions.

bash

# Disable Bluetooth at runtime and prevent module load at boot
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
sudo rfkill block bluetooth

# Blacklist Bluetooth modules until a patched kernel is deployed
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo update-initramfs -u