In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()<\/p>\n
bt_accept_dequeue() unlinks a not-yet-accepted child from the parent
\naccept queue and release_sock()s it before returning, so the returned
\nsk has no caller reference and is unlocked.<\/p>\n
l2cap_sock_cleanup_listen() walks these children on listening-socket
\nclose. A concurrent HCI disconnect drives hci_rx_work ->
\nl2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and
\nfrees the child sk and its l2cap_chan; cleanup_listen() then uses both:<\/p>\n
BUG: KASAN: slab-use-after-free in l2cap_sock_kill
\n l2cap_sock_kill \/ l2cap_sock_cleanup_listen \/ __x64_sys_close
\n Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill<\/p>\n
This is distinct from the two fixes already in this area: commit
\ne83f5e24da741 (“Bluetooth: serialize accept_q access”) serialises the
\naccept_q list\/poll and takes temporary refs inside bt_accept_dequeue(),
\nand CVE-2025-39860 serialises the userspace close()\/accept() race by
\ncalling cleanup_listen() under lock_sock() in l2cap_sock_release().
\nNeither covers l2cap_conn_del() running from hci_rx_work, so this UAF
\nstill reproduces on current bluetooth\/master.<\/p>\n
Take the reference at the source: bt_accept_dequeue() does sock_hold()
\nwhile sk is still locked, before release_sock(); callers sock_put().
\ncleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under
\na brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops
\nit before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on
\nSOCK_DEAD. conn->lock is not taken here: cleanup_listen() runs under
\nthe parent sk lock and that would invert
\nconn->lock -> chan->lock -> sk_lock (lockdep).<\/p>\n
KASAN\/SMP: an unprivileged listen\/close vs HCI-disconnect race produced
\n12 use-after-free reports per run before this change; 0, and no lockdep
\nreport, over 1600+ raced iterations after it on bluetooth\/master.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()<\/p>\n
bt_accept_dequeue() unlinks a not-yet-accepted child from th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12699","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}