Race Condition in Bluetooth Module of Linux Kernel

CVE-2026-31500

What is CVE-2026-31500?

A race condition exists within the Bluetooth module of the Linux kernel, specifically involving the btintel hardware error handling. The function btintel_hw_error() calls __hci_cmd_sync() without proper locking, which results in an opportunity for concurrent access by other functions such as btintel_shutdown_combined(). This improper synchronization can lead to a use-after-free condition, potentially allowing a malicious actor to exploit it and affect system stability. To mitigate this, the recovery sequence must be wrapped in synchronization locks to ensure that no other commands interfere during execution.

References