CVE-2026-80762

A flaw was found in the Bluetooth subsystem of the Linux kernel. During the system suspend process, a timing issue can occur where the hci_update_event_filter_sync() function attempts to access memory that has already been released. This Use-After-Free (UAF) vulnerability could allow a local attacker to cause a system crash, leading to a denial of service, or potentially execute arbitrary code with elevated privileges.

A use-after-free can occur in the Bluetooth HCI suspend path because hci_update_event_filter_sync walks hdev accept_list while synchronous HCI commands may wait for controller responses. During that wait a concurrent remove_device operation can delete and free the current accept list entry, after which the suspend path may read the freed list next pointer and crash in hci_suspend_sync. For the CVSS the PR:L is used for the paranoid score because local Bluetooth management access, a reduced-capability service account, or delegated HCI control may be enough to race accept list updates with suspend handling. The issue is not directly network reachable over IP and normally requires local interaction with HCI or management control paths plus a suspend related execution window. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact because the primitive is a real kernel use-after-free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.