Threats tagged 'ghsa-m8vr-v3r8-7vqf'

A race condition vulnerability in the Linux kernel Bluetooth subsystem (hci_sync) has been resolved. The issue occurs in the function hci_cmd_sync_dequeue_once(), where lookup and cancellation of an entry happen under separate locks, while another function, hci_cmd_sync_work(), can concurrently delete the same entry. This leads to a double list deletion and use-after-free (UAF) condition. The fix involves holding the cmd_sync_work_lock across both lookup and cancel operations to prevent concurrent removal of the entry.