CVE-2026-31500
Use-After-Free in Linux Bluetooth btintel Driver Causes Kernel Crash
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.3 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
| linux | linux_kernel | From 4.3.1 (inc) to 6.6.131 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth subsystem, specifically in the btintel driver. The function btintel_hw_error() issues two synchronous HCI commands without holding the hci_req_sync_lock(), which leads to a race condition with the close path (hci_dev_do_close() -> btintel_shutdown_combined()) that also uses the same lock. Because both paths manipulate shared data concurrently without proper synchronization, the close path may free a response buffer while the hw_error path is still using it, causing a use-after-free error in memory.
The fix involves wrapping the entire recovery sequence in the hci_req_sync_lock/unlock to serialize access and prevent the race condition.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Bluetooth driver, which may cause system instability, crashes, or potential kernel memory corruption. Such issues could be exploited to cause denial of service or potentially escalate privileges if an attacker can trigger the race condition.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by serializing the btintel_hw_error() function with hci_req_sync_lock to prevent race conditions. Immediate mitigation involves updating the Linux kernel to a version where this fix is applied.
Specifically, ensure your system is running a Linux kernel version that includes the patch wrapping the recovery sequence in hci_req_sync_lock/unlock to serialize synchronous HCI command issuers.