CVE-2026-80764

A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could exploit a use-after-free vulnerability in the hci_event component. This occurs when the hci_cc_reset() function clears Bluetooth Low Energy (LE) lists without proper locking, allowing a debugfs reader to access freed memory. Successful exploitation could lead to memory corruption, potentially causing system instability or a denial of service.

A race in Bluetooth hci_cc_reset can clear LE accept and resolving list entries without holding hdev lock while a debugfs reader is walking the same lists. This creates a use after free where white_list_show may read fields from a freed entry and may follow a stale next pointer, leading to a kernel crash and possible stale heap data exposure. For the CVSS the PR:L is used for the higher paranoid scenario because a local user or service account with access to Bluetooth debugfs reads and ability to trigger or race controller reset could reach the vulnerable path without full host administrator privileges in some deployments. The issue is not directly network reachable because it depends on local debugfs access and Bluetooth controller reset handling rather than remote packet processing. Impact is at least local denial of service via kernel crash, with possible confidentiality impact from stale kernel heap reads. No clear integrity impact or privilege escalation primitive is proven by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.