{"id":"CVE-2025-68304","revision":"739000c310b34750b62507ced3d00b88","records":[{"revision":"739000c310b34750b62507ced3d00b88","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-68304","aliases":[],"title":"Bluetooth: hci_core: lookup hci_conn on RX path on protocol side","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: lookup hci_conn on RX path on protocol side\n\nThe hdev lock/lookup/unlock/use pattern in the packet RX path doesn't\nensure hci_conn* is not concurrently modified/deleted. This locking\nappears to be leftover from before conn_hash started using RCU\ncommit bf4c63252490b (\"Bluetooth: convert conn hash to RCU\")\nand not clear if it had purpose since then.\n\nCurrently, there are code paths that delete hci_conn* from elsewhere\nthan the ordered hdev->workqueue where the RX work runs in. E.g.\ncommit 5af1f84ed13a (\"Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync\")\nintroduced some of these, and there probably were a few others before\nit.  It's better to do the locking so that even if these run\nconcurrently no UAF is possible.\n\nMove the lookup of hci_conn and associated socket-specific conn to\nprotocol recv handlers, and do them within a single critical section\nto cover hci_conn* usage and lookup.\n\nsyzkaller has reported a crash that appears to be this issue:\n\n    [Task hdev->workqueue]          [Task 2]\n                                    hci_disconnect_all_sync\n    l2cap_recv_acldata(hcon)\n                                      hci_conn_get(hcon)\n                                      hci_abort_conn_sync(hcon)\n                                        hci_dev_lock\n      hci_dev_lock\n                                        hci_conn_del(hcon)\n      v-------------------------------- hci_dev_unlock\n                                      hci_conn_put(hcon)\n      conn = hcon->l2cap_data (UAF)","state":0,"publishedAt":"2025-12-16T15:06:21.887+00:00","modifiedAt":"2026-10-15T22:02:48.882+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/bluetooth/hci_core.h\",\n                        \"net/bluetooth/hci_core.c\",\n                        \"net/bluetooth/iso.c\",\n                        \"net/bluetooth/l2cap_core.c\",\n                        \"net/bluetooth/sco.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5af1f84ed13a416297ab9ced7537f4d5ae7f329a\",\n                            \"lessThan\": \"ec74cdf77310c43b01b83ee898a9bd4b4b0b8e93\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5af1f84ed13a416297ab9ced7537f4d5ae7f329a\",\n                            \"lessThan\": \"79a2d4678ba90bdba577dc3af88cc900d6dcd5ee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cd55c13bbb3d093ae601aa97e588ed4c1390ebb1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4d3ca4a9aaf0aa798a6be372dc0fc3a29e37dd57\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"80265dd1d944c3f33e52375b5dbe654980bd2688\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.1.149\",\n                            \"lessThan\": \"6.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.4.16\",\n                            \"lessThan\": \"6.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.5.3\",\n                            \"lessThan\": \"6.6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/bluetooth/hci_core.h\",\n                        \"net/bluetooth/hci_core.c\",\n                        \"net/bluetooth/iso.c\",\n                        \"net/bluetooth/l2cap_core.c\",\n                        \"net/bluetooth/sco.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17.11\",\n                            \"lessThanOrEqual\": \"6.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ec74cdf77310c43b01b83ee898a9bd4b4b0b8e93","https://git.kernel.org/stable/c/79a2d4678ba90bdba577dc3af88cc900d6dcd5ee"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-68304","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-68304","identifiers":["CVE-2025-68304"]},"retained":false,"historicalAffected":[]}],"coverage":[]}