CVE-2026-80764 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth HCI implementation teams, Linux distribution maintainers, and security teams responsible for vulnerability management and patch deployment should assess exposure and verify remediation. Operators of systems using the affected Linux kernel versions should also be aware of the potential risks and take necessary precautions.

Why it matters

This vulnerability requires attention from Linux kernel developers, Bluetooth HCI implementation teams, and Linux distribution maintainers due to its potential for system crashes and information disclosure. Verification of affected systems and application of patches are necessary to mitigate the vulnerability.

• Potential system crash due to use-after-free condition
• Possible information disclosure through accessed freed list entries
• Verification of HCI reset command handling and debugfs reader interactions is required
• Remediation priority is medium due to potential for exploitation

Technical summary

The vulnerability exists in the Linux kernel's Bluetooth HCI event handling. The HCI reset command handler clears the LE accept and resolving lists without acquiring the required lock, leading to a potential use-after-free condition. A debugfs reader can access a freed list entry, resulting in a potential crash or information disclosure. This issue requires attention from Linux kernel developers and maintainers, Bluetooth HCI implementation teams, and Linux distribution maintainers due to its potential for system crashes and information disclosure.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to ensure the vulnerability is addressed.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Verify that affected systems are properly configured and up-to-date.
• Perform a thorough review of HCI reset command handling and debugfs reader interactions.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was reported by an unnamed researcher and was resolved by taking the hdev->lock around both list clears in the HCI reset command handler. The fix matches the existing mutation and traversal locking convention.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.