CVE-2026-43322

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix UAF in le_read_features_complete

This fixes the following backtrace caused by hci_conn being freed

before le_read_features_complete but after

hci_le_read_remote_features_sync so hci_conn_del -> hci_cmd_sync_dequeue

is not able to prevent it:

==================================================================

BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]

BUG: KASAN: slab-use-after-free in atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline]

BUG: KASAN: slab-use-after-free in hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline]

BUG: KASAN: slab-use-after-free in le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344

Write of size 4 at addr ffff8880796b0010 by task kworker/u9:0/52

CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

Workqueue: hci0 hci_cmd_sync_work

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:94 [inline]

dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120

print_address_description mm/kasan/report.c:378 [inline]

print_report+0xcd/0x630 mm/kasan/report.c:482

kasan_report+0xe0/0x110 mm/kasan/report.c:595

check_region_inline mm/kasan/generic.c:194 [inline]

kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:200

instrument_atomic_read_write include/linux/instrumented.h:96 [inline]

atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline]

hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline]

le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344

hci_cmd_sync_work+0x1ff/0x430 net/bluetooth/hci_sync.c:334

process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257

process_scheduled_works kernel/workqueue.c:3340 [inline]

worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421

kthread+0x3c5/0x780 kernel/kthread.c:463

ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158

ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

</TASK>

Allocated by task 5932:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:56

kasan_save_track+0x14/0x30 mm/kasan/common.c:77

poison_kmalloc_redzone mm/kasan/common.c:400 [inline]

__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:417

kmalloc_noprof include/linux/slab.h:957 [inline]

kzalloc_noprof include/linux/slab.h:1094 [inline]

__hci_conn_add+0xf8/0x1c70 net/bluetooth/hci_conn.c:963

hci_conn_add_unset+0x76/0x100 net/bluetooth/hci_conn.c:1084

le_conn_complete_evt+0x639/0x1f20 net/bluetooth/hci_event.c:5714

hci_le_enh_conn_complete_evt+0x23d/0x380 net/bluetooth/hci_event.c:5861

hci_le_meta_evt+0x357/0x5e0 net/bluetooth/hci_event.c:7408

hci_event_func net/bluetooth/hci_event.c:7716 [inline]

hci_event_packet+0x685/0x11c0 net/bluetooth/hci_event.c:7773

hci_rx_work+0x2c9/0xeb0 net/bluetooth/hci_core.c:4076

process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257

process_scheduled_works kernel/workqueue.c:3340 [inline]

worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421

kthread+0x3c5/0x780 kernel/kthread.c:463

ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158

ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Freed by task 5932:

kasan_save_stack+0x33/0x60 mm/kasan/common.c:56

kasan_save_track+0x14/0x30 mm/kasan/common.c:77

__kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587

kasan_save_free_info mm/kasan/kasan.h:406 [inline]

poison_slab_object mm/kasan/common.c:252 [inline]

__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284

kasan_slab_free include/linux/kasan.h:234 [inline]

slab_free_hook mm/slub.c:2540 [inline]

slab_free mm/slub.c:6663 [inline]

kfree+0x2f8/0x6e0 mm/slub.c:6871

device_release+0xa4/0x240 drivers/base/core.c:2565

kobject_cleanup lib/kobject.c:689 [inline]

kobject_release lib/kobject.c:720 [inline]

kref_put include/linux/kref.h:65 [inline]

kobject_put+0x1e7/0x590 lib/kobject.

---truncated---