CVE-2026-80692

A flaw was found in the Bluetooth hci_sync component of the Linux kernel. This vulnerability, a Use-After-Free (UAF), could allow a local attacker to potentially cause a system crash or execute unauthorized code. This occurs if a connection object is released from memory while the hci_sync task is still using it, leading to unpredictable system behavior or a denial of service.

A moderate-severity use-after-free flaw was found in the Linux kernel's Bluetooth hci_sync implementation. The hci_connect_acl/le_sync() callbacks were queued without holding a reference to the Bluetooth connection (hci_conn) object, so if that object is freed while an hci_sync task is still running, later callback processing can dereference stale kernel memory. A local attacker with low privileges able to influence or initiate Bluetooth connection attempts could race connection teardown to crash the kernel (denial of service); upstream characterizes this as a theoretical use-after-free, and reliable code execution is considered unlikely. Red Hat Product Security rates this flaw as Moderate with local attack vector and availability-only impact (CVSS 5.5). The affected scope is Red Hat Enterprise Linux 9 (kernel and kernel-rt in the 9.6 and later update streams), Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2, where the introducing change is present. Red Hat Enterprise Linux 6, 7, and 8, as well as the RHEL 9.2 and 9.4 update streams, are not affected because the vulnerable code is not present in those streams. Fixes for the affected products are currently deferred because the flaw is theoretical and difficult to trigger reliably; the residual risk is primarily local denial of service through a kernel crash. The higher upstream severity (CVEORG 8.8, adjacent-network vector with high confidentiality and integrity impact) differs from Red Hat's assessment because Red Hat judges that reliable triggering requires local access with privileges and that the practical impact is limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.