CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync

Synopsis

A use-after-free vulnerability exists in the Linux kernel's Bluetooth HCI connection handling, specifically in the create_big_sync() function within hci_conn. An attacker with a low-privilege local account can trigger the flaw without any victim interaction. Successful exploitation gives the attacker full read, write, and crash capability over the affected system. Patched-image rebuilds at the fix versions (6.6.140 and 6.12.90, among others) are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerability; no admin or elevated credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing sensitive data such as credentials, keys, or session state held in kernel space.
• A successful attacker writes to arbitrary kernel memory, allowing modification of kernel data structures, security policy, or process credentials.
• A successful attacker can crash the affected system by corrupting kernel state through the use-after-free, causing a denial of service.
• The combination of read, write, and crash primitives makes privilege escalation to root practical from any low-privilege local account.