EUVD-2026-108808
GHSA-pm9c-823q-m3hj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access with Bluetooth control
-
DeliveryTrigger PA sync scan setup repeatedly
-
ExploitWin workqueue race freeing command skb
-
ExecutionDereference freed kernel memory (UAF)
-
ImpactCorrupt memory for escalation or DoS
Vulnerability Assessment
| Exploitation Conditions | Requires local access on a system with the Bluetooth subsystem active and the ability to drive a PA_LINK/Periodic Advertising sync operation that reaches hci_le_pa_create_sync → hci_passive_scan_sync → hci_le_set_ext_scan_param_sync; the flaw triggers only when the command worker (hci_cmd_work on the device workqueue) frees and replaces sent_cmd/req_skb during the window the scan worker (req_workqueue) uses that borrowed skb storage. Limiting factors: no remote vector (AV:L), a low-privileged local foothold with Bluetooth control is needed (PR:L), the running kernel must be an affected version (6.6.28+/6.8.7+ before the fixes), and success depends on winning a tight timing race between two workqueues, which makes reliable exploitation difficult. |
| Impact | Signals point to a genuine but moderate-priority local kernel bug rather than an urgent internet-facing threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) confines exploitation to a local, low-privileged user and rates full confidentiality/integrity/availability impact, consistent with a kernel use-after-free that can corrupt memory. Countervailing signals lower real-world urgency: EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit was identified - only vendor fix commits. The vuln.today decision label is 'this_week', aligning with patch-on-normal-cadence rather than emergency. One discrepancy to verify: the input Tags label this 'Information Disclosure', but the CVSS vector claims C:H/I:H/A:H (full triad), which is broader than pure disclosure and typical of a UAF with code-execution/escalation potential - do not treat the 'Information Disclosure' tag as the authoritative impact. Also note the described mechanism is a timing race between two workqueues, which in practice reduces exploitation reliability below what AC:L suggests. |
| Exploit ScenarioDerived | A local user able to initiate Bluetooth Periodic Advertising (PA) sync operations repeatedly triggers PA sync scan setup so the scan worker (req_workqueue) and the command worker (device workqueue) race; the command worker frees and replaces sent_cmd/req_skb while the scan path still dereferences it, producing a kernel slab use-after-free (as KASAN reported). Winning this narrow race could allow memory corruption leading to privilege escalation or a kernel crash. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
A use-after-free in the Linux kernel Bluetooth HCI command-sync path affects kernels from 6.6.28 and 6.8.7 onward, up to the fixed releases, and is triggered when a Periodic Advertising (PA_LINK) sync setup causes the scan worker on req_workqueue to keep using command skb storage that the command worker on the device workqueue has already freed and replaced. A local, low-privileged user able to drive Bluetooth HCI/PA sync operations can win a tight race between those two workqueues, producing a KASAN slab-use-after-free in hci_sent_cmd_data with the potential for memory corruption and privilege escalation; the assessed vector is AV:L/AC:H/PR:L, reflecting that reliable exploitation depends on winning that timing window. No public exploit code is identified at time of analysis, the flaw is not in CISA KEV, and EPSS is low at 0.21% (11th percentile), which is consistent with a genuine but moderate-priority local kernel bug rather than an internet-facing emergency; vendor patches are available.
RemediationAI
Apply the vendor-released kernel patches: update to Linux 6.6.160 on the 6.6.y branch, 6.12.114 on 6.12.y, 6.18.57 on 6.18.y, or 7.2.11/7.3 on the newer branches, each of which corresponds to the stable commits f01cbddfb4273fcc9a786d13b0a2525029023605, 119ba8070b3f112dd36c897f4f70ea5bb7d370b8, 7db33b36213a3a1a40940c009ddac30670b55922, 762850c203fab1190ad6a3de41cd51920b22236d and 9af12272061d206af8bc3e40215cb694421ab73a available at git.kernel.org/stable and linked from https://nvd.nist.gov/vuln/detail/CVE-2026-99014; the change takes hdev->lock around the sent_cmd/req_skb address snapshot so it cannot be freed mid-lookup, and takes effect only after the kernel is rebuilt and rebooted. Until the patched kernel can be deployed, reduce exposure by limiting which local users can drive Bluetooth HCI operations and Periodic Advertising sync setup (for example by restricting access to HCI sockets and Bluetooth management interfaces to trusted privileged processes), with the trade-off that legitimate Bluetooth scanning, LE Audio and PA-sync tooling used by unprivileged applications will stop working; such restriction only narrows the set of possible racers and does not remove the underlying skb lifetime bug, since the vendor's fix is the complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The bug lives in the Bluetooth host controller interface command-sync machinery. hci_le_set_ext_scan_param_sync() obtains the address used for its PA_LINK lookup from hci_sent_cmd_data(), a helper that returns a pointer borrowing storage from either sent_cmd or req_skb without taking a reference to either skb. Because the scan worker executes on req_workqueue while hci_cmd_work() executes on the separate device workqueue, the command worker can free and replace sent_cmd after the scan worker has loaded it but before hci_sent_cmd_data() dereferences it, and the command payload can likewise be freed between the helper return and the address comparison; the RCU critical section protecting the connection lookup does not cover the command skb. The result is the reported slab-use-after-free in hci_sent_cmd_data reached via hci_le_set_scan_param_sync -> hci_passive_scan_sync -> hci_update_passive_scan_sync -> hci_le_pa_create_sync -> hci_cmd_sync_work. No CWE identifier was supplied in the source data, but the flaw is a memory-lifetime/skbture-reuse defect in the HCI command submission layer (the kernel commit message explicitly cites skb lifetime). The upstream fix serializes the address snapshot with sent_cmd replacement using hdev->lock, protects req_skb replacement and completion cleanup with the same lock since the helper falls back to that skb, copies the address before releasing the lock, uses that copy for the existing RCU-protected connection lookup, and releases the mutex before sending or waiting on commands so lookup and completion ordering is preserved.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel bug (AV:L) requiring a low-privileged user to drive Bluetooth ops (PR:L); the described cross-workqueue race makes the trigger timing-dependent (AC:H); UAF yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: Fix command skb lifetime during scan setup
During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the address used for the PA_LINK lookup from hci_sent_cmd_data(). The returned pointer borrows storage from sent_cmd or req_skb, without holding a reference to either skb.
The scan worker runs on req_workqueue while hci_cmd_work() runs on the separate device workqueue. After the scan worker loads sent_cmd, the command worker can free and replace it before hci_sent_cmd_data() dereferences the skb. The command payload can also be freed between returning from the helper and comparing the address. The connection lookup's RCU critical section does not protect the command skb.
KASAN reported:
BUG: KASAN: slab-use-after-free in hci_sent_cmd_data+0x27c/0x2f0 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_sent_cmd_data+0x27c/0x2f0 hci_le_set_scan_param_sync+0x43a/0x850 hci_passive_scan_sync+0xb09/0x1460 hci_update_passive_scan_sync+0x47c/0x6e0 hci_le_pa_create_sync+0x200/0xa70 hci_cmd_sync_work+0x13c/0x290
Allocated by task 95: skb_clone+0x13f/0x340 hci_cmd_work+0x2a9/0x7e0
Freed by task 95: kmem_cache_free+0xba/0x3a0 hci_cmd_work+0x29c/0x7e0
Use hdev->lock to serialize the address snapshot with sent_cmd replacement. Protect req_skb replacement and completion cleanup with the same lock because the helper falls back to that skb. Copy the address before releasing the lock and use the copy for the existing RCU-protected connection lookup. Release the mutex before sending or waiting for commands, preserving the lookup and completion ordering.
Executive ViewAI
A high-severity use-after-free vulnerability in the Linux kernel's Bluetooth subsystem affects a broad range of recent kernel versions. Successful exploitation requires local access and a precise timing race, but could lead to privilege escalation. While no public exploit exists and active exploitation is not confirmed, organizations with Linux endpoints or servers using Bluetooth should prioritize patching to mitigate potential risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB