CVE-2026-80762 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth subsystem developers, users of Linux-based systems that utilize Bluetooth functionality, system administrators, security teams, and operators of Linux-based infrastructure, as well as organizations relying on Linux-based systems for critical operations or services.

Why it matters

A use-after-free vulnerability in the Linux kernel's Bluetooth subsystem could lead to system instability, potential privilege escalation, and requires prompt patching.

• Potential system crashes or instability due to use-after-free condition
• Possible elevation of privileges or unauthorized access via Bluetooth
• Required patching and updating of Linux kernel to prevent exploitation

Technical summary

The vulnerability occurs in the hci_sync module of the Linux kernel's Bluetooth subsystem. The hci_update_event_filter_sync function walks the hdev->accept_list while sending a synchronous HCI command for each remote-wakeup device. The suspend path holds hdev->req_lock, but accept-list updates are serialized by hdev->lock. Consequently, remove_device can free the current list entry during the controller wait, leading to a use-after-free condition. The issue was resolved by snapshotting the remote-wakeup addresses under hdev->lock and releasing the lock before sending HCI commands.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor system logs for potential exploitation attempts
• Perform a thorough review of the system for any signs of compromise
• Inventory and track all Linux-based systems that utilize Bluetooth functionality
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Review and update incident response plans to include procedures for handling potential exploitation of this vulnerability

Evidence notes

The vulnerability was reported by KASAN, which detected a slab-use-after-free in hci_suspend_sync+0x835/0x910. The issue was resolved by snapshotting the remote-wakeup addresses under hdev->lock and releasing the lock before sending HCI commands.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.