Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c before f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805; affected 881559af5f5c545f6828e7c74d79813eb886d523 before 301a4e2e89313dee10f0e8cb084daedbbe4a3dce; affected 881559af5f5c545f6828e7c74d79813eb886d523 before a4de6fc95b2f36967fc247ae51cad2171194f7cd; affected 881559af5f5c545f6828e7c74d79813eb886d523 before 9a77f296aff4b2ca5f2928ab3a3220c82d8b4074; affected 881559af5f5c545f6828e7c74d79813eb886d523 before 2f5d635ad5906b0235bc0c870e8beba3116e1e98; affected 5dd0bd277a0a936708a33ecc447dce77a08cbde6; affected 6.6.51 before 6.6.160; affected 6.8.9 before 6.9 |
| Linux / Linux | affected 6.9; unaffected 0 before 6.9; unaffected 6.6.160 through 6.6.*; unaffected 6.12.114 through 6.12.*; unaffected 6.18.57 through 6.18.*; unaffected 7.1.8 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805
- https://git.kernel.org/stable/c/301a4e2e89313dee10f0e8cb084daedbbe4a3dce
- https://git.kernel.org/stable/c/a4de6fc95b2f36967fc247ae51cad2171194f7cd
- https://git.kernel.org/stable/c/9a77f296aff4b2ca5f2928ab3a3220c82d8b4074
- https://git.kernel.org/stable/c/2f5d635ad5906b0235bc0c870e8beba3116e1e98
ADP enrichment
No English description supplied.
No references supplied.