## Summary
The Linux kernel Bluetooth subsystem contains a vulnerability in hci_sync related to connection lifetime management. A theoretical use-after-free (UAF) could occur if the hci_conn is freed while the hci_sync task is still running.
## Technical Details
The issue is addressed by holding a reference to the connection (hci_conn) across the synchronous command lifecycle.
- Root cause (as described): theoretical UAF if conn is freed while the hci_sync task is running.
- Fix approach:
- In hci_connect_pa_sync(), the code now passes hci_conn_get(conn) into hci_cmd_sync_queue_once(...) so the callback has a valid reference.
- If hci_cmd_sync_queue_once(...) fails, the code releases the extra reference via hci_conn_put(conn).
- In create_pa_complete(...), the callback now ensures hci_conn_put(conn) is called on completion (including the -ECANCELED path via a goto done).
Relevant code identifiers from the patch:
- net/bluetooth/hci_sync.c
- hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn)
- hci_cmd_sync_queue_once(hdev, hci_le_pa_create_sync, ...)
- create_pa_complete(struct hci_dev *hdev, void *data, int err)
- hci_conn_get(conn) / hci_conn_put(conn)
## Affected
- Linux kernel Bluetooth hci_sync code path involving hci_connect_pa_sync() and create_pa_complete() (file: net/bluetooth/hci_sync.c).
## Impact
- Potential use-after-free (UAF) leading to memory corruption.
- CVSS indicates high impact across confidentiality/integrity/availability (per provided metrics), with local attack vector (AV:L).
## Mitigation
1. Apply the upstream/stable kernel patch that adds hci_conn_get(conn) in hci_connect_pa_sync() and ensures hci_conn_put(conn) in create_pa_complete().
2. Ensure your kernel is updated to a version containing commit 44fc74069d8988f2825246f9401218e29de2c0ab (and the stable backport c53c70ec289ee12f20c4f1b2fbfd151762c01f67).
3. If immediate patching is not possible, reduce exposure to Bluetooth features that trigger PA sync operations, and monitor for kernel crashes consistent with UAF (no specific indicators were provided in the references).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H