CVE-2026-53072

A flaw was found in the Linux kernel's Bluetooth subsystem. Improper handling of locking within the hci_conn_request_evt() function, particularly when the HCI_PROTO_DEFER protocol is active, can result in a Use-After-Free (UAF) vulnerability. This condition arises when a connection object is accessed after it has been deallocated, potentially allowing a local attacker to cause a system crash or execute arbitrary code.

Bluetooth hci_conn_request_evt can call hci_connect_cfm without hdev lock when HCI_PROTO_DEFER is set, while hci_connect_cfm normally assumes the device lock is held. If the connection object is deleted concurrently, this creates a race based use after free on conn and can crash the kernel. The reachable protocol context appears limited to deferred SCO listen handling because ISO does not generate HCI_EV_CONN_REQUEST. For the CVSS the PR:N is used in the paranoid score because an attacker only needs adjacent Bluetooth reachability to initiate the relevant connection request when the victim exposes the affected listening state. The issue is not Internet network reachable and requires Bluetooth radio proximity plus timing of the race.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.