Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will free the btusb data associated with the interface. The same data is then used later in the function, hence the UAF. Fix by moving the accesses to btusb data to before the data is free'd.
References (8)
Core 8
Core References
Scores
EPSS
0.0008
EPSS Percentile
22.8%
Details
Status
published
Products (25)
linux/Kernel
4.11.0 - 5.4.302linux
linux/Kernel
5.11.0 - 5.15.197linux
linux/Kernel
5.16.0 - 6.1.159linux
linux/Kernel
5.5.0 - 5.10.247linux
linux/Kernel
6.13.0 - 6.17.9linux
linux/Kernel
6.2.0 - 6.6.117linux
linux/Kernel
6.7.0 - 6.12.59linux
Linux/Linux
< 4.11
Linux/Linux
4.11
Linux/Linux
5.10.247 - 5.10.*
... and 15 more
Published
Dec 06, 2025
Tracked Since
Feb 18, 2026