Description
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

There is theoretical UAF if the conn is freed while the hci_sync task
is running.

Hold refcount to avoid that.
Published: 2026-08-28
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Use‑After‑Free
Action: Update Kernel
AI Analysis

Impact

A theoretical use‑after‑free condition exists in the Linux kernel Bluetooth HCI module when a connection object may be freed while a synchronization task is still executing. The flaw was addressed by adding a reference count to the connection, preventing the dangling reference.

Affected Systems

The flaw affects any Linux kernel that has not incorporated the refcount fix in the hci_sync subsystem of the Bluetooth HCI layer. It is not limited to a particular distribution or release; all affected images must verify inclusion of the referenced commits.

Risk and Exploitability

The CVSS score of 8.8 marks the issue as high severity, while the very low EPSS score of less than 1 % indicates a small likelihood of real‑world exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The report highlights a theoretical use‑after‑free but does not describe a known exploitation path.

Generated by OpenCVE AI on September 2, 2026 at 05:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a kernel update that includes the hci_sync reference‑count change from the referenced commits.
  • Reboot the system or reload the affected kernel modules to ensure the updated code is active.
  • If an immediate kernel upgrade is not feasible, disable or restrict Bluetooth services to limit the attack surface.

Generated by OpenCVE AI on September 2, 2026 at 05:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 29 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416

Sat, 29 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 29 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 28 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.
Title Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-29T06:22:15.862Z

Reserved: 2026-08-26T14:34:25.785Z

Link: CVE-2026-80692

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:54.690

Modified: 2026-08-29T07:16:51.360

Link: CVE-2026-80692

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80692 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T05:45:04Z

Weaknesses
  • CWE-911

    Improper Update of Reference Count