{"id":"CVE-2026-80764","summary":"Bluetooth: hci_event: fix LE list UAF on reset","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix LE list UAF on reset\n\nhci_cc_reset() clears the LE accept and resolving lists without taking\nhdev-\u003elock. Other command-complete handlers serialize updates to these\nlists with that lock, and the debugfs readers hold it while walking them.\n\nThis permits the reset completion and a debugfs read to interleave as\nfollows:\n\n  hci_rx_work                 debugfs reader\n  -----------                 --------------\n                              lock hdev-\u003elock\n                              fetch current entry\n  list_del(entry)\n  kfree(entry)\n                              read entry fields\n\nThe reader then dereferences a freed list entry and may follow its stale\nnext pointer.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in white_list_show+0x15f/0x180\n  Read of size 1 at addr ffff8881015dab16 by task poc/95\n\n  Call Trace:\n   white_list_show+0x15f/0x180\n   seq_read_iter+0x3ff/0x1190\n   seq_read+0x267/0x3d0\n   vfs_read+0x177/0xa20\n   ksys_read+0xf7/0x1c0\n\n  Allocated by task 91:\n   hci_bdaddr_list_add+0x1a6/0x3a0\n   hci_cc_le_add_to_accept_list+0xab/0x140\n   hci_cmd_complete_evt+0x26c/0x9a0\n   hci_event_packet+0x454/0xb20\n   hci_rx_work+0x293/0x730\n\n  Freed by task 90:\n   kfree+0x131/0x3c0\n   hci_bdaddr_list_clear+0xd8/0x160\n   hci_cc_reset+0x28a/0x370\n   hci_cmd_complete_evt+0x26c/0x9a0\n   hci_event_packet+0x454/0xb20\n   hci_rx_work+0x293/0x730\n\nTake hdev-\u003elock around both list clears. This matches the existing\nmutation and traversal locking convention.","modified":"2026-11-06T17:27:21.112256035Z","published":"2026-09-04T15:12:36.599Z","related":["SUSE-SU-2026:24550-1","SUSE-SU-2026:5091-1","SUSE-SU-2026:5121-1","openSUSE-SU-2026:11773-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80764.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0628cc9b2fa29985a7b8c774741f8a736b0f5e7c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/25b05e3ce31d954540e99954bcc66cbceb27ab35"},{"type":"WEB","url":"https://git.kernel.org/stable/c/33af47e847fe4a28b109673affb5874015d54f5a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/39a3afb91be3cb465f46ce7a8e5696d9e33edf93"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8e68c380290b1dd64a0a512ce66d0264130c46ed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b55e83a4ba31d40deae22d4e4dc8c84083e953c6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d57702d4c55633c243da5a2fec37ae2ad4adb621"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80764.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80764"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a4d5504d5c39cc84f1f828e19967595597a8136e"},{"fixed":"8e68c380290b1dd64a0a512ce66d0264130c46ed"},{"fixed":"0628cc9b2fa29985a7b8c774741f8a736b0f5e7c"},{"fixed":"d57702d4c55633c243da5a2fec37ae2ad4adb621"},{"fixed":"39a3afb91be3cb465f46ce7a8e5696d9e33edf93"},{"fixed":"b55e83a4ba31d40deae22d4e4dc8c84083e953c6"},{"fixed":"25b05e3ce31d954540e99954bcc66cbceb27ab35"},{"fixed":"33af47e847fe4a28b109673affb5874015d54f5a"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3.18.3"},{"fixed":"3.19"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0de8cd646b0152c9ddd10257d8284938d0df0181"}]}],"versions":["v3.18.140","v3.18.139","v3.18.138","v3.18.137","v3.18.136","v3.18.135","v3.18.134","v3.18.133","v3.18.132","v3.18.131","v3.18.130","v3.18.129","v3.18.128","v3.18.127","v3.18.126","v3.18.125","v3.18.124","v3.18.123","v3.18.122","v3.18.121","v3.18.120","v3.18.119","v3.18.118","v3.18.117","v3.18.116","v3.18.115","v3.18.114","v3.18.113","v3.18.112","v3.18.111","v3.18.110","v3.18.109","v3.18.108","v3.18.107","v3.18.106","v3.18.105","v3.18.104","v3.18.103","v3.18.102","v3.18.101","v3.18.100","v3.18.99","v3.18.98","v3.18.97","v3.18.96","v3.18.95","v3.18.94","v3.18.93","v3.18.92","v3.18.91","v3.18.90","v3.18.89","v3.18.88","v3.18.87","v3.18.86","v3.18.85","v3.18.84","v3.18.83","v3.18.82","v3.18.81","v3.18.80","v3.18.79","v3.18.78","v3.18.77","v3.18.76","v3.18.75","v3.18.74","v3.18.73","v3.18.72","v3.18.71","v3.18.70","v3.18.69","v3.18.68","v3.18.67","v3.18.66","v3.18.65","v3.18.64","v3.18.63","v3.18.62","v3.18.61","v3.18.60","v3.18.59","v3.18.58","v3.18.57","v3.18.56","v3.18.55","v3.18.54","v3.18.53","v3.18.52","v3.18.51","v3.18.50","v3.18.49","v3.18.48","v3.18.47","v3.18.46","v3.18.45","v3.18.44","v3.18.43","v3.18.42","v3.18.41","v3.18.40","v3.18.39","v3.18.38","v3.18.37","v3.18.36","v3.18.35","v3.18.34","v3.18.33","v3.18.32","v3.18.31","v3.18.30","v3.18.29","v3.18.28","v3.18.27","v3.18.26","v3.18.25","v3.18.24","v3.18.23","v3.18.22","v3.18.21","v3.18.20","v3.18.19","v3.18.18","v3.18.17","v3.18.16","v3.18.15","v3.18.14","v3.18.13","v3.18.12","v3.18.11","v3.18.10","v3.18.9","v3.18.8","v3.18.7","v3.18.6","v3.18.5","v3.18.4","v3.18.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80764.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0"},{"fixed":"6.1.185"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.154"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.106"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.47"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"fixed":"7.2.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80764.json"}}],"schema_version":"1.9.2"}