Linux Kernel EUVD-2026-59449

Exploitation requires all of the following: (1) local system access with at minimum standard user-level (low) privileges; (2) a Bluetooth HCI-capable hardware device present and actively registered with the kernel; (3) the ability to trigger hci_unregister_dev() - for example via physical removal of a USB Bluetooth adapter or through a device management interface the user can reach - while cmd_timer or ncmd_timer has a pending callback. The race window is inherently narrow, making reliable triggering timing-dependent in practice despite the AC:L rating in the official CVSS vector. Systems without Bluetooth hardware, systems where Bluetooth is disabled at the kernel configuration level, or environments where local users have no access to device management operations are not exploitable. Remote or unauthenticated exploitation is not possible - this is a strictly local attack path.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high potential impact but is strictly local, requiring low-privilege access. Independent assessment raises AC to High given the race condition's timing sensitivity - reliable exploitation requires the timer to fire within a narrow window during device teardown, which the AC:L rating in the official vector may understate. The EPSS score of 0.17% at the 6th percentile is consistent with this complexity: reliable kernel race-condition exploits rarely see opportunistic mass exploitation. CISA KEV does not list this CVE and no public exploit code has been identified, making this a lower-urgency item compared to remotely exploitable or KEV-listed flaws. That said, even a mid-sized municipal IT team in walbrzych should treat this as a near-term patching priority, since kernel UAF vulnerabilities in widely-shipped subsystems like Bluetooth are high-value escalation primitives for post-compromise attackers, patches are already available with no compatibility trade-offs cited, and delay serves no operational purpose.

A local user with low-privilege access triggers Bluetooth HCI device unregistration - for example by physically removing a USB Bluetooth adapter - while cmd_timer or ncmd_timer is armed with a pending callback. In the narrow race window between hci_dev being freed and the timer callback executing, the callback dereferences the stale hdev->reset function pointer. Depending on heap layout at that moment, this could redirect kernel execution to attacker-controlled memory or cause an immediate kernel panic. No public exploit code has been identified at time of analysis.