EUVD-2026-59449
GHSA-78xg-w78v-wc27
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition during device teardown requires precise timing to win the window, warranting AC:H; PR:L reflects the need for local access to interact with Bluetooth hardware.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
hci_unregister_dev() does not disable cmd_timer and ncmd_timer before the hci_dev structure is freed. If a timeout fires during device teardown, the callback dereferences freed memory (including the hdev->reset function pointer), leading to a use-after-free.
Add disable_delayed_work_sync() calls alongside the existing disable_work_sync() calls to ensure both timers are fully quiesced before teardown proceeds.
AnalysisAI
Use-after-free in the Linux kernel Bluetooth HCI core subsystem allows a local attacker with low privileges to corrupt kernel memory and potentially escalate privileges or crash the system. The hci_unregister_dev() function fails to quiesce cmd_timer and ncmd_timer delayed work items before freeing the hci_dev structure, creating a race window where timer callbacks dereference stale memory including the hdev->reset function pointer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) local system access with at minimum standard user-level (low) privileges; (2) a Bluetooth HCI-capable hardware device present and actively registered with the kernel; (3) the ability to trigger hci_unregister_dev() - for example via physical removal of a USB Bluetooth adapter or through a device management interface the user can reach - while cmd_timer or ncmd_timer has a pending callback. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high potential impact but is strictly local, requiring low-privilege access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with low-privilege access triggers Bluetooth HCI device unregistration - for example by physically removing a USB Bluetooth adapter - while cmd_timer or ncmd_timer is armed with a pending callback. In the narrow race window between hci_dev being freed and the timer callback executing, the callback dereferences the stale hdev->reset function pointer. … |
| Remediation | Apply the vendor-provided patches available for all affected stable kernel branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with Bluetooth kernel support enabled by querying module status and comparing kernel versions against your distribution's patched releases. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today