In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb<\/p>\n
BT enable fails intermittently with -ETIMEDOUT (-110). The kernel log
\nshows the HCI Read Local Version command was sent and the firmware
\nreplied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG),
\nbut the waiter in __hci_cmd_sync_sk() never woke up and timed out
\nafter 10 s:<\/p>\n
bluetooth hci0: Opcode 0xfc00 \/\/ __hci_cmd_sync_sk
\n bluetooth hci0: opcode 0xfc00 plen 1 \/\/ hci_cmd_sync_add
\n bluetooth hci0: skb len 4 \/\/ hci_cmd_sync_alloc
\n bluetooth hci0: length 1 \/\/ hci_req_sync_run
\n Bluetooth: hci0 cmd_cnt 1 cmd queued 1 \/\/ hci_cmd_work
\n Bluetooth: hci0 type 1 len 4 \/\/ hci_send_frame
\n Bluetooth: opcode 0xfc00 status 0x00 \/\/ hci_req_cmd_complete<\/p>\n
bluetooth hci0: end: err -110 \/\/ __hci_cmd_sync_sk<\/p>\n
The root cause is that hci_send_cmd_sync() clones the sent command
\ninto hdev->req_skb so that hci_req_cmd_complete() can locate the
\nregistered completion callback. Under memory pressure this
\nskb_clone() fails, leaving hdev->req_skb NULL. The firmware reply
\nis received and processed, but hci_req_cmd_complete() finds NULL
\nreq_skb, so hci_cmd_sync_complete() is never called, req_status
\nstays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT.<\/p>\n
req_skb is only used to read bt_cb(skb)->hci callbacks and opcode —
\nit is never modified. Replace skb_clone() with skb_get(), which
\nsimply increments the reference count of hdev->sent_cmd without
\nallocating new memory and therefore cannot fail.<\/p>\n
This issue was first observed as a use-after-free in ttyport_close()
\nwhen ttyport_open() failed, which was investigated in an earlier
\npatch series [1]. That investigation led to the discovery of the
\ntrue root cause described above.<\/p>\n
[1] https:\/\/lore.kernel.org\/all\/20250430111617.1151390-1-quic_cxin@quicinc.com\/<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb<\/p>\n
BT enable fails intermittently with -ETIMEDOUT (-110). The <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28473","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}