CVE-2026-46111

Technical summary

CVE-2026-46111 is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the create_big_sync() and create_big_complete() functions. The vulnerability arises from improper lifecycle management of hci_conn objects across asynchronous boundaries. When create_big_complete() is called, it unconditionally dereferences the connection pointer without verifying the connection is still valid, and without holding a reference that prevents the object from being freed. The fix involves: (1) adding hci_conn_valid() checks in create_big_sync() to detect stale connections; (2) implementing reference counting via hci_conn_get()/hci_conn_put() to keep the connection object allocated during async operations; (3) re-validating the connection under hci_dev_lock() in the completion callback before dereferencing; and (4) handling the -ECANCELED error code appropriately. This pattern mirrors existing safe handling in create_le_conn_complete() and create_pa_complete().

Business impact

Exploitation could lead to kernel panic and system denial of service. In production environments, this could interrupt services relying on Bluetooth connectivity or cause unexpected system restarts. Additionally, depending on memory layout and exploit sophistication, the UAF could potentially be leveraged for privilege escalation or code execution, though such exploitation would require local access and additional techniques. Systems with Bluetooth enabled and unprivileged user access are at elevated risk.

Affected systems

The Linux kernel is affected across multiple versions. The vulnerability impacts systems where Bluetooth is enabled and ISO (Isochronous) connections are supported. Any Linux distribution shipping an unpatched kernel with Bluetooth subsystem support is vulnerable. Embedded systems, IoT devices, and desktops/laptops with Bluetooth chipsets are included in the affected scope.

Exploitability

Exploitation requires local access (AV:L) and no special privileges are needed beyond standard user-level permissions (PR:L). No user interaction is required (UI:N). The attack surface is relatively low compared to network-based vulnerabilities, but the barrier to entry is minimal for local users. Triggering the vulnerability requires manipulating Bluetooth connection state, which could be done through standard Bluetooth management tools or by crafting specific connection sequences. The CVSS score of 7.8 reflects high impact (confidentiality, integrity, and availability all affected) combined with local accessibility.

Remediation

Apply the upstream Linux kernel patch that implements proper reference counting and validation in the BIG creation pathway. The fix ensures connections are validated before use and held with hci_conn_get() during async operations, with corresponding hci_conn_put() calls in completion handlers. Verify against the vendor advisory for exact patched kernel versions applicable to your distribution. Administrators should prioritize kernel updates for systems with Bluetooth enabled and local user access.

Patch guidance

Contact your Linux distribution vendor for patched kernel releases. Upstream kernel patches addressing this issue should be available in stable kernel branches following the original fix. When updating, verify the specific kernel version includes commits addressing create_big_sync() reference counting and hci_conn_valid() checks. Test in a staging environment before production deployment, particularly if Bluetooth ISO functionality is actively used. Monitor kernel changelogs and distribution security advisories for official CVE patches.

Detection guidance

Monitor system logs for BIG connection creation failures and unexpected kernel panics, particularly those occurring during Bluetooth ISO connection establishment. Kernel crash dumps (if available) showing stack traces in create_big_complete() or related Bluetooth connection handling functions may indicate exploitation attempts. Runtime monitoring of Bluetooth connection state transitions and ISO stream creation could detect anomalous behavior. Consider enabling kernel address sanitizer (KASAN) or similar debugging on test systems to catch UAF conditions earlier.

Why prioritize this

This vulnerability merits high priority due to its HIGH CVSS severity (7.8), local accessibility, and the potential for both denial of service and privilege escalation. The lack of privilege escalation requirements and the straightforward triggering mechanism make it practically exploitable. However, its local-only nature means network-facing systems without direct user terminal access face lower immediate risk. Prioritize patching for multi-user systems, shared hosting environments, and systems where untrusted users may have local shell access.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (systems must be locally accessible); Attack Complexity Low (no special conditions required); Privileges Required Low (standard user sufficient); User Interaction None (no user action needed); Scope Unchanged (impact limited to the affected system); and high impact across Confidentiality, Integrity, and Availability (all marked High due to potential code execution and system crash). The score appropriately captures a serious local vulnerability that is practical to exploit but requires initial local access.

Frequently asked questions