Linux Kernel EUVD-2026-55578

The Linux kernel's Bluetooth subsystem uses the HCI (Host Controller Interface) management layer (mgmt) to handle device pairing and disconnection. The affected code paths - unpair_device() and disconnect_sync() - operate on hci_conn structures representing active Bluetooth connections. These structures are protected by RCU (Read-Copy-Update), a kernel synchronization mechanism that permits lock-free reads within RCU read-side critical sections; outside those sections, held references may become stale as the kernel's deferred reclamation can free the underlying memory. The bug is that hci_conn lookup and the subsequent hci_abort_conn() call were performed without holding hdev->lock, meaning a concurrent disconnection or cleanup path could free the hci_conn while the function still held a pointer to it, producing a classic UAF condition. The fix replaces reliance on RCU with acquisition of hdev->lock to guarantee the connection object remains live and fully initialized throughout the critical region. CPE data (cpe:2.3:a:linux:linux:*) confirms this affects the upstream Linux kernel across a broad version range. No CWE is formally assigned in the input, but the root cause maps to CWE-416 (Use After Free) driven by CWE-667 (Improper Locking).