important · Bluetooth — Linux
Two overlapping outgoing BLE connections can wedge Linux Bluetooth until adapter reset.
Affects
Linux kernel Bluetooth central hosts, demonstrated with a BCM43438 controller.
A rejected second connection can remain in BT_CONNECT, causing every later outgoing LE connection to return EBUSY until the adapter is reset; upstream reports normal connections after the fix.
Detail and 1 source
Chain to watch
Queue two overlapping outgoing LE connections→↓Leave the rejected connection stuck in BT_CONNECT→↓Block later outgoing BLE connections until reset→↓Nearby unauthenticated reachability from a stock configuration is unproven.
Unverified chainRepeat with two attacker-controlled advertisers and no pre-provisioned peers across common controllers.
The reproduction uses two peers polled together, and it does not establish that an unauthenticated nearby device can create the required pending identities on an ordinarily configured host.