CVE-2026-31500
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock. When both paths manipulate hdev->req_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb(). Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer. Below is the data race report and the kasan report: BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030 write/free by task ioctl/22580: btintel_shutdown_combined+0xd0/0x360 drivers/bluetooth/btintel.c:3648 hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246 hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526 BUG: KASAN: slab-use-after-free in sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202 Read of size 4 at addr ffff888144a738dc by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| Linux Linux |
≥ 973bb97e5aee56edddaae3d5c96877101ad509c0; < 7e041d0aad1d4d43d921ace052e04f4e2cacaed3 (affected, git) ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0; < 5f84e845648dfa86e42de5487f1a774b42f0444d (affected, git) ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0; < e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5 (affected, git) ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0; < 66696648af477dc87859e5e4b607112f5f29d010 (affected, git) ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0; < f7d84737663ad4a120d2d8ef1561a4df91282c2e (affected, git) ≥ 973bb97e5aee56edddaae3d5c96877101ad509c0; < 94d8e6fe5d0818e9300e514e095a200bd5ff93ae (affected, git) Other versions: unaffected |
CNA: Linux |
| Linux Linux |
4.3 (affected) ≥ 0; < 4.3 (unaffected, semver) ≥ 6.1.175; ≤ 6.1.* (unaffected, semver) ≥ 6.6.131; ≤ 6.6.* (unaffected, semver) ≥ 6.12.80; ≤ 6.12.* (unaffected, semver) ≥ 6.18.21; ≤ 6.18.* (unaffected, semver) ≥ 6.19.11; ≤ 6.19.* (unaffected, semver) ≥ 7.0; ≤ * (unaffected, original_commit_for_fix) Other versions: affected |
CNA: Linux |
| SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Siemens |
≥ 0; < * (affected, custom)
Other versions: unknown |
ADP: siemens-SADP |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
No CVSS assessment reported. An unscored record is not a low-severity determination.
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3CNA: Linux
- https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444dCNA: Linux
- https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5CNA: Linux
- https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010CNA: Linux
- https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2eCNA: Linux
- https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93aeCNA: Linux
- https://cert-portal.siemens.com/productcert/html/ssa-784472.htmlADP: siemens-SADP
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.