CVE-2026-64405: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()

hci_abort_conn() read hci_skb_event(hdev->sent_cmd) when a connection
was pending, but hdev->sent_cmd can be NULL while req_status is still
HCI_REQ_PEND, leading to a NULL pointer dereference and a general
protection fault from the hci_rx_work() receive path.

Instead of inspecting hdev->sent_cmd, track the in-flight create
connection command with a new per-connection HCI_CONN_CREATE flag and
route all cancellation through hci_cancel_connect_sync(), which
dispatches to a dedicated per-type cancel function. The create command
is in exactly one of two states: still queued, or in flight. The cancel
function holds cmd_sync_work_lock across the whole decision: the worker
takes this lock to dequeue every entry, so while it is held a queued
command cannot start running and an in-flight command cannot complete
and let the next command become pending. This keeps the flag test and
hci_cmd_sync_cancel() atomic with respect to the worker, so a queued
command is simply dequeued, and an in-flight command owned by this
connection is cancelled without the risk of cancelling an unrelated
command that became pending in the meantime. CIS uses the same flag
mechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection.

hci_acl_create_conn_sync() and hci_le_create_conn_sync() clear
HCI_CONN_CREATE after the create command completes, but the command
status handler can free conn via hci_conn_del() (for example when the
controller rejects the connection) while the worker is still blocked on
the connection complete event. Hold a reference on conn across the
create command so the flag can be cleared without a use-after-free.

The Linux kernel CVE team has assigned CVE-2026-64405 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1.83 with commit 6083089ab00631617f9eac678df3ab050a9d837a and fixed in 6.1.118 with commit 903227b6168bb99fd57d4e3c9c1b5014986198e0
	Issue introduced in 6.6 with commit a13f316e90fdb1fb6df6582e845aa9b3270f3581 and fixed in 6.6.145 with commit 83b22d7f7c384564fa42c3cf19bec715c693d7a2
	Issue introduced in 6.6 with commit a13f316e90fdb1fb6df6582e845aa9b3270f3581 and fixed in 6.12.97 with commit 70c397b62ee015e19b3924d9da741c8dda017819
	Issue introduced in 6.6 with commit a13f316e90fdb1fb6df6582e845aa9b3270f3581 and fixed in 6.18.39 with commit 61701912c58a05f6a043f097cc177a964abef348
	Issue introduced in 6.6 with commit a13f316e90fdb1fb6df6582e845aa9b3270f3581 and fixed in 7.1.4 with commit b42cb640a0493d16b61ddd267420274be15efdc1
	Issue introduced in 6.6 with commit a13f316e90fdb1fb6df6582e845aa9b3270f3581 and fixed in 7.2-rc3 with commit 12917f591cea1af36087dba5b9ec888652f0b42a
	Issue introduced in 6.4.16 with commit e4511a67fcdba9729d1c7cfc6d2e645c765ce801
	Issue introduced in 6.5.3 with commit 4ab81f16c68a602b2b69e333ae08d8748a9398de

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64405
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/bluetooth/hci_core.h
	net/bluetooth/hci_conn.c
	net/bluetooth/hci_sync.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/903227b6168bb99fd57d4e3c9c1b5014986198e0
	https://git.kernel.org/stable/c/83b22d7f7c384564fa42c3cf19bec715c693d7a2
	https://git.kernel.org/stable/c/70c397b62ee015e19b3924d9da741c8dda017819
	https://git.kernel.org/stable/c/61701912c58a05f6a043f097cc177a964abef348
	https://git.kernel.org/stable/c/b42cb640a0493d16b61ddd267420274be15efdc1
	https://git.kernel.org/stable/c/12917f591cea1af36087dba5b9ec888652f0b42a