CVE-2026-68189

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_sync: Protect UUID list traversal<br /> <br /> The hci_sync conversion moved class-of-device and EIR generation from an<br /> HCI request built under hdev-&gt;lock to asynchronous command sync work.<br /> The worker holds hdev-&gt;req_lock, but that lock does not serialize access<br /> to hdev-&gt;uuids against add_uuid() and remove_uuid(), which update the<br /> list under hdev-&gt;lock.<br /> <br /> The following interleaving can therefore occur:<br /> <br /> CPU0 (command sync work) CPU1 (management socket)<br /> fetch uuid from the list<br /> list_del(&amp;uuid-&gt;list)<br /> kfree(uuid)<br /> read uuid-&gt;size<br /> <br /> KASAN reports the resulting use-after-free:<br /> <br /> BUG: KASAN: slab-use-after-free in eir_create+0xb8f/0xee0<br /> Read of size 1 at addr ffff88810dbd8620 by task kworker/u17:0/87<br /> Workqueue: hci0 hci_cmd_sync_work<br /> Call Trace:<br /> eir_create+0xb8f/0xee0<br /> hci_update_eir_sync+0x1c0/0x330<br /> hci_cmd_sync_work+0x13c/0x290<br /> process_one_work+0x63a/0x1070<br /> worker_thread+0x45b/0xd10<br /> <br /> Allocated by task 86:<br /> __kasan_kmalloc+0x8f/0xa0<br /> add_uuid+0x18a/0x4b0<br /> hci_sock_sendmsg+0x1033/0x1ea0<br /> <br /> Freed by task 92:<br /> __kasan_slab_free+0x43/0x70<br /> kfree+0x131/0x3c0<br /> remove_uuid+0x25e/0x560<br /> hci_sock_sendmsg+0x1033/0x1ea0<br /> <br /> Hold hdev-&gt;lock while generating and committing the class-of-device and<br /> EIR snapshots. Release it before sending an HCI command, so controller<br /> waits do not happen under the device lock. This protects all UUID list<br /> walks in these paths and restores the serialization lost in the command<br /> sync conversion.