Linux Kernel EUVD-2026-55577

The vulnerability resides in the Linux kernel Bluetooth management (mgmt) subsystem, specifically in how hci_conn objects are tracked within mgmt_pending_cmd structures and used inside hci_sync callbacks. RCU (Read-Copy-Update) is a Linux kernel synchronization primitive that permits lock-free reads under a critical section guard; dereferencing RCU-protected pointers outside these critical sections is unsafe because the memory can be reclaimed concurrently. The bug has two related facets: first, hci_conn pointers stored in mgmt_pending_cmd are not reference-counted, so the hci_conn object can be freed while the pending command still holds a raw pointer; second, hci_conn objects used in hci_sync callbacks similarly lack refcount protection, creating a parallel UAF window. Separately, accesses to conn->state are performed without holding hdev->lock, constituting a classic TOCTOU data race. CPE data identifies the affected product as cpe:2.3:a:linux:linux (Linux kernel), with the vulnerable code introduced at commit 7b445e220db9a2c58be5d09bbbd322abf1b1452a and spanning multiple stable series from Linux 6.0 onward. No formal CWE is assigned in the input, but the root cause class is clearly CWE-416 (Use After Free) compounded by CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization).