Linux Kernel EUVD-2026-55579

Exploitation requires the attacker to be physically adjacent to the target - within Bluetooth radio range (AV:A), typically 10-100 meters depending on hardware class. Bluetooth must be enabled and operationally active on the target kernel; systems with Bluetooth hardware disabled via rfkill or with the Bluetooth kernel modules unloaded are not vulnerable. The target kernel must be running a version prior to the fix commits (before 6.12.28, 6.14.6, 7.1.6, or equivalent stable backports). The race condition requires concurrent Bluetooth connection activity - specifically, conn_hash deletion racing with hci_sync lookup - which may occur naturally with multiple nearby Bluetooth devices or may require the attacker to stimulate connection teardown. No authentication is required from the attacker (PR:N per CVSS vector). Systems without Bluetooth hardware, with Bluetooth hardware rfkill-blocked, or running patched kernel versions are not affected.

The NVD CVSS vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields an 8.8 score, reflecting the severity of kernel UAF with full confidentiality, integrity, and availability impact. However, AC:L may overstate exploitability: triggering a race condition between conn_hash lookup and concurrent deletion requires winning a timing window, which in practice is non-trivial and may warrant AC:H. The EPSS score of 0.17% (6th percentile) strongly supports lower near-term exploitation probability - this is consistent with a complex kernel race condition that requires physical proximity. There is no CISA KEV listing and no public POC identified, meaning this is not currently a mass-exploitation risk. The primary real-world concern is targeted local-network or proximity-based attacks against Bluetooth-enabled systems running unpatched kernels, particularly embedded or IoT Linux devices where Bluetooth is discoverable. The combination of high theoretical impact but low EPSS and no known exploit makes this a patch-when-possible priority rather than an emergency response item for most environments.

An attacker within Bluetooth radio range (typically up to 10-100 meters) of an unpatched Linux system sends a crafted Bluetooth connection request that triggers the hci_sync connection lookup path. By simultaneously inducing rapid connection teardown on a separate thread (or racing with background Bluetooth activity), the attacker causes the conn_hash pointer to be freed while hci_sync is still dereferencing it, triggering a use-after-free. Successful exploitation could allow the attacker to redirect kernel execution flow, potentially achieving a kernel panic (denial of service) or, with carefully crafted heap manipulation, arbitrary code execution at ring-0. No public exploit code has been identified, making reliable exploitation difficult without significant kernel exploitation expertise.