EUVD-2026-67427
GHSA-fg5w-g6pm-xp23
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H because the UAF exploits a narrow race condition between concurrent kernel threads, requiring timing precision beyond what AC:L implies; all other metrics follow the provided vector.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
There is theoretical UAF if the conn is freed while the hci_sync task is running.
Hold refcount to avoid that.
AnalysisAI
Use-after-free in the Linux kernel Bluetooth HCI sync subsystem exposes systems running vulnerable kernel versions (6.6.51-pre-6.7 and 6.8.9-pre-6.9) to potential kernel-context memory corruption from an adjacent attacker with no privileges required. The race condition occurs when hci_connect_acl/le_sync() callbacks dereference a freed hci_conn object during concurrent connection teardown, yielding a theoretical path to arbitrary code execution or kernel panic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be within Bluetooth radio range of the target host. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 base score reflects adjacent network access, no required privileges, and full confidentiality, integrity, and availability impact - a combination that would normally indicate high urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the upstream kernel fix commits available at https://git.kernel.org/stable/c/9a77f296aff4b2ca5f2928ab3a3220c82d8b4074 and https://git.kernel.org/stable/c/2f5d635ad5906b0235bc0c870e8beba3116e1e98; distribution-specific packages incorporating these commits (noted as stable releases 7.1.8 and 7.2 in EUVD data) should be applied via the normal OS update mechanism. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan infrastructure to identify Linux systems running vulnerable kernel versions 6.6.51-pre-6.7 or 6.8.9-pre-6.9 with Bluetooth enabled; segregate critical production systems from general inventory for priority handling. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today