CVE-2026-72335

This CVE exposes a use-after-free in the Linux Bluetooth subsystem's advertising monitor lifecycle. The bug stems from a split-ownership race between the MGMT layer and the MSFT controller interface: hci_add_adv_monitor() inserts the monitor into the hdev->adv_monitors_idr before the MSFT setup operation completes, but the MSFT async callback can free the monitor on failure while the MGMT completion handler still holds a pointer to it. KASAN caught this when one task freed the monitor in msft_add_monitor_sync while another task's MGMT handler tried to read monitor->handle milliseconds later. The fix restructures ownership to keep the monitor tied to the pending management command until completion, but this is a specific patch for a structural problem. The pattern—inserting resources into shared structures before async operations confirm success—likely exists elsewhere in the Bluetooth subsystem. When auditing similar code paths, look for IDR/idr insertions that precede hardware command completion, especially where callback-based async patterns interact with synchronous completion handlers. The severity context matters: Bluetooth's proximity-based trust model means successful exploitation doesn't just corrupt memory—it operates at a boundary where untrusted proximate devices can interact with the subsystem as a core function. This changes the risk profile compared to similar bugs in filesystems or network stacks that sit behind authenticated interfaces. Assume this class of bug can be reached by attackers within radio range, not just by local privileged code.

Reviewed through automated stages and approved by a human before publication.