CVE-2026-53072: Linux Kernel Bluetooth Use-After-Free Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-53072 is a use-after-free vulnerability in the Linux kernel's Bluetooth HCI (Host Controller Interface) layer. The vulnerability exists in the hci_conn_request_evt() function, which processes incoming Bluetooth connection requests. When HCI_PROTO_DEFER is set (used by SCO and ISO protocols for deferred connection setup), the function calls hci_connect_cfm() without holding the required hdev->lock mutex. The hci_connect_cfm() function internally assumes this lock is held; without it, a concurrent thread can delete the connection object (conn) while hci_connect_cfm() is still dereferencing it, resulting in a use-after-free condition. The fix involves ensuring hdev->lock is held during the hci_connect_cfm() call, consistent with how non-deferred listening socket code paths handle this operation.

Business impact

This vulnerability affects the availability and confidentiality of Linux systems with Bluetooth capabilities. A local attacker with access to the system can trigger the vulnerability through Bluetooth connection manipulation, potentially causing kernel panics (denial of service) or, in more sophisticated scenarios, leveraging the memory corruption to escalate privileges. Organizations running Bluetooth-enabled Linux systems in multi-user or containerized environments face increased risk. Remote exploitation is limited by the Bluetooth attack surface (typically requiring physical proximity or network access to Bluetooth), but local exploitation is straightforward.

Affected systems

The vulnerability affects the Linux kernel; all versions that include the vulnerable hci_conn_request_evt() code path are potentially impacted. Specifically, systems running Bluetooth (CONFIG_BT enabled) are vulnerable. SCO (Synchronous Connection Oriented) and ISO (Isochronous) Bluetooth profiles are the primary vectors, though the vulnerability is in the core HCI event handler. This includes desktop Linux, embedded Linux systems, IoT devices, and specialized hardware running Linux with Bluetooth support. Verify the specific kernel version in your environment against the Linux kernel security advisories for exact patched versions.

Exploitability

The vulnerability has a CVSS 3.1 score of 8.8 (HIGH) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack vector is Adjacent Network (AV:A), meaning the attacker must have local or Bluetooth-proximity access; it is not remotely exploitable over the internet. The attack complexity is low, no privileges are required, and user interaction is not necessary. The scope is unchanged, and all three security impacts (confidentiality, integrity, availability) are high. This makes it a serious local/proximity threat but not a widespread remote threat. As of the provided data, this vulnerability has not been designated as exploited in the wild (KEV status is false).

Remediation

Apply a Linux kernel security update that includes the fix for CVE-2026-53072. The remedy is to patch hci_conn_request_evt() to ensure hdev->lock is held during the hci_connect_cfm() call. Consult your Linux distribution's security advisories (Red Hat, Ubuntu, Debian, SUSE, etc.) for the specific kernel version that resolves this issue. Until patched, restrict Bluetooth access on sensitive systems and monitor for unexpected Bluetooth connections or kernel crashes.

Patch guidance

1. Check your current Linux kernel version (uname -r). 2. Visit your distribution's security advisories (e.g., Red Hat Security Updates, Ubuntu Security Notices, Debian Security Advisories). 3. Search for CVE-2026-53072 to identify the patched kernel version for your distribution. 4. Schedule a kernel update during a maintenance window. 5. Verify the patch is applied by checking the kernel changelog or rebuilding if running a custom kernel. 6. Reboot to activate the patched kernel. 7. For systems that cannot be rebooted immediately, implement the mitigations listed below.

Detection guidance

Detection of exploitation is challenging without kernel instrumentation. Monitor for: (1) Unexpected kernel panic or reboot messages in syslog related to Bluetooth (search dmesg for 'hci' or 'bluetooth' near panic timestamps); (2) Unusual Bluetooth connection attempts followed by system instability; (3) Elevated kernel CPU usage or softirq activity; (4) In containerized or multi-tenant environments, monitor for privilege escalation attempts following Bluetooth anomalies. Use intrusion detection tuning to flag rapid or repeated Bluetooth connection attempts. Kernel lockdown mode and SELinux/AppArmor policies can help mitigate the impact if exploitation is attempted.

Why prioritize this

Prioritize patching based on: (1) System exposure: Linux systems with Bluetooth enabled in multi-user environments or exposed to untrusted local users are highest priority; (2) Attack surface: IoT devices, embedded systems, and edge nodes running Bluetooth are significant targets; (3) CVSS score of 8.8 (HIGH) and broad impact scope; (4) The non-KEV status suggests patches may not yet be widely deployed, creating a window of vulnerability; (5) Local exploitation is trivial once proximity/access is achieved. Mid-to-large organizations should patch within 30 days; critical infrastructure and high-availability systems should prioritize patches within 1-2 weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Low attack complexity—no special conditions or race condition tuning required; (2) No authentication or privileges needed—any local user or Bluetooth-proximate attacker can trigger it; (3) High impact on all security pillars (confidentiality, integrity, availability) due to use-after-free enabling both DoS and potential privilege escalation; (4) Attack vector limited to adjacent network, reducing the score from critical but keeping it high. The non-KEV status and lack of widespread public exploitation do not diminish the technical severity; this is a kernel memory corruption vulnerability that warrants urgent patching.

Frequently asked questions