CVE-2026-43322

A flaw was found in the Bluetooth Host Controller Interface (HCI) synchronization module (hci_sync) of the Linux kernel. A use-after-free (UAF) vulnerability exists in the le_read_features_complete function, where a freed hci_conn object is accessed. This can allow an attacker to cause a system crash, leading to a denial of service.

A Moderate impact use-after-free flaw was found in the Linux kernel Bluetooth Host Controller Interface (HCI) command synchronization code, affecting the Red Hat Enterprise Linux 10 kernel. In the le_read_features_complete() handler in net/bluetooth/hci_sync.c, the completion callback of the HCI LE Read Remote Features command can execute after the associated hci_conn object has already been freed: when the LE connection is dropped after hci_le_read_remote_features_sync() queues the command but before the callback runs, hci_conn_del() -> hci_cmd_sync_dequeue() cannot cancel the pending callback, which then dereferences the freed connection through hci_conn_drop(), producing a slab use-after-free write. An attacker who can race Bluetooth LE connection establishment, disconnection, and the remote-feature read, from a local position or potentially as a Bluetooth peer within radio range, could trigger this flaw to crash the kernel and cause a denial of service; because this is a use-after-free write on a freed kernel object, a worst case could involve confidentiality or integrity impact, although only denial of service has been demonstrated. Red Hat assigned this flaw a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in the upstream CVE record, reflecting the assessment that exploitation requires winning a timing race (high attack complexity) with local privileges rather than reliable unauthenticated exploitation over Bluetooth. Of the Red Hat products in scope, only the Red Hat Enterprise Linux 10 kernel is affected (the rhel-10.2.z and rhel-10.3 update streams, into which the vulnerable code was introduced together with support for the LL Extended Feature Set); a fix is being pursued for those streams. Red Hat Enterprise Linux 6, 7, 8, and 9 (including ELS, z, and kernel-rt streams), Red Hat Enterprise Linux 10.0 and 10.1, and Red Hat In-Vehicle OS 2.0 are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.