CVE-2026-80692

CVE-2026-80692 is a use-after-free (UAF) vulnerability in the Bluetooth subsystem of the Linux kernel, in the hci_sync connection-establishment code. Per the upstream fix, if the connection object (conn) is freed while the hci_sync task is still running, code reached from the hci_connect_acl()/hci_connect_le_sync() callbacks can dereference freed memory; the fix holds an extra reference (refcount) on the connection to prevent this. Because the flaw sits in Bluetooth ACL/LE connection setup, it would be triggered by a race during connection establishment, and the CVSS vector (adjacent network, low complexity, no privileges or user interaction required) indicates a local radio-range attacker could potentially gain high confidentiality, integrity and availability impact via memory corruption or a crash. All Linux systems running kernels with the affected hci_sync Bluetooth code are potentially affected; the source data does not enumerate specific kernel version ranges or a fixed release. No public proof-of-concept exists, the issue is not in CISA KEV, and EPSS estimates only a ~0.2% probability of exploitation in the next 30 days (12th percentile), so there is no known exploitation at this time.

What to do: Upgrade affected systems to a kernel release that includes the upstream fix commit 'Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks' — the data does not name a fixed version, so follow your distribution's kernel advisory and verify the commit in the package changelog. As a mitigation on unpatched or long-lived systems, disable or restrict Bluetooth (e.g., rfkill, blacklisting the btusb module, or removing adapters) where it is not needed, prioritizing devices that operate in public, radio-reachable environments.