Linux Kernel EUVD-2026-67427

Exploitation requires the attacker to be within Bluetooth radio range of the target host. The target must be running a vulnerable Linux kernel version (6.6.51-pre-6.7 or 6.8.9-pre-6.9) with Bluetooth hardware present, and the Bluetooth kernel subsystem must be active (bluetooth and hci_uart/btusb modules loaded and not rfkill-blocked or disabled in firmware). Successful exploitation also depends on winning a race condition between the hci_sync callback and connection object teardown - a timing-sensitive constraint that limits reliable exploitation without significant effort. No authentication is required from the target (PR:N per CVSS), and no user interaction is needed. Limiting factors include: mandatory Bluetooth radio proximity, kernel version specificity, the narrow race window requiring timing precision or repeated attempts, and the absence of any known public exploit. Systems with Bluetooth absent, disabled in BIOS/UEFI, rfkill-blocked, or with the bluetooth module blacklisted are not affected.

The CVSS 8.8 base score reflects adjacent network access, no required privileges, and full confidentiality, integrity, and availability impact - a combination that would normally indicate high urgency. However, multiple signals reduce real-world exploitation likelihood: the kernel commit description explicitly labels the UAF 'theoretical,' signaling a narrow or difficult-to-reproduce race window; EPSS at 0.15% (5th percentile) confirms negligible observed exploitation probability; the vulnerability is absent from CISA KEV; and no public exploit code exists. The CVSS-provided AC:L is assessed here as likely optimistic - UAF exploitation via race condition typically demands precise timing or repeated attempts, warranting AC:H in this analyst's independent vector. The mandatory Bluetooth radio proximity constraint (AV:A) substantially narrows the attacker population relative to network-reachable flaws, limiting opportunistic mass exploitation. Patching remains the correct course of action during normal maintenance cycles, but the theoretical nature of the race and absence of observed exploitation do not support emergency out-of-cycle remediation for most organizations.

An attacker within Bluetooth radio range (typically up to 100 meters for Class 1 adapters) sends crafted Bluetooth ACL or LE connection setup traffic to a vulnerable Linux host, timing the request to race the kernel's hci_sync work queue callback against concurrent connection teardown. If the narrow race window is won - either through repeated attempts or precise timing control - the callback dereferences a freed hci_conn object, potentially allowing kernel-context code execution or triggering a kernel panic and system crash. No public exploit code has been identified at time of analysis.