CVE-2026-68189: Bluetooth: hci_sync: Protect UUID list traversal

CVE-2026-68189: Bluetooth: hci_sync: Protect UUID list traversal

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Protect UUID list traversal

The hci_sync conversion moved class-of-device and EIR generation from an
HCI request built under hdev->lock to asynchronous command sync work.
The worker holds hdev->req_lock, but that lock does not serialize access
to hdev->uuids against add_uuid() and remove_uuid(), which update the
list under hdev->lock.

The following interleaving can therefore occur:

  CPU0 (command sync work)       CPU1 (management socket)
  fetch uuid from the list
                                list_del(&uuid->list)
                                kfree(uuid)
  read uuid->size

KASAN reports the resulting use-after-free:

  BUG: KASAN: slab-use-after-free in eir_create+0xb8f/0xee0
  Read of size 1 at addr ffff88810dbd8620 by task kworker/u17:0/87
  Workqueue: hci0 hci_cmd_sync_work
  Call Trace:
   eir_create+0xb8f/0xee0
   hci_update_eir_sync+0x1c0/0x330
   hci_cmd_sync_work+0x13c/0x290
   process_one_work+0x63a/0x1070
   worker_thread+0x45b/0xd10

  Allocated by task 86:
   __kasan_kmalloc+0x8f/0xa0
   add_uuid+0x18a/0x4b0
   hci_sock_sendmsg+0x1033/0x1ea0

  Freed by task 92:
   __kasan_slab_free+0x43/0x70
   kfree+0x131/0x3c0
   remove_uuid+0x25e/0x560
   hci_sock_sendmsg+0x1033/0x1ea0

Hold hdev->lock while generating and committing the class-of-device and
EIR snapshots.  Release it before sending an HCI command, so controller
waits do not happen under the device lock.  This protects all UUID list
walks in these paths and restores the serialization lost in the command
sync conversion.

The Linux kernel CVE team has assigned CVE-2026-68189 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit 161510ccf91c961638940b03abb1ee804be53a97 and fixed in 6.6.148 with commit e4fa2c5c261d736b8e58759fdef3a968d510630c
	Issue introduced in 5.17 with commit 161510ccf91c961638940b03abb1ee804be53a97 and fixed in 6.12.101 with commit a351f68fb24828b23a971e00b8238ee0e8a40380
	Issue introduced in 5.17 with commit 161510ccf91c961638940b03abb1ee804be53a97 and fixed in 6.18.42 with commit a42f5536ea9c00e13f0c0fbb330feed95e2365ca
	Issue introduced in 5.17 with commit 161510ccf91c961638940b03abb1ee804be53a97 and fixed in 7.1.6 with commit fe13adc258df88d95789e5673c7ba5178b5f8b28
	Issue introduced in 5.17 with commit 161510ccf91c961638940b03abb1ee804be53a97 and fixed in 7.2-rc5 with commit e9027ffbf5a0f3c12ca8900822e884eae9f0821b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68189
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/hci_sync.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e4fa2c5c261d736b8e58759fdef3a968d510630c
	https://git.kernel.org/stable/c/a351f68fb24828b23a971e00b8238ee0e8a40380
	https://git.kernel.org/stable/c/a42f5536ea9c00e13f0c0fbb330feed95e2365ca
	https://git.kernel.org/stable/c/fe13adc258df88d95789e5673c7ba5178b5f8b28
	https://git.kernel.org/stable/c/e9027ffbf5a0f3c12ca8900822e884eae9f0821b