CVE-2026-43018

Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt

State: Published
Severity: 8.8 High
Published: May 1, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt

hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently.

Extend the hci_dev_lock critical section to cover all conn usage.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	95118dd4edfec950898a00180c6f998df0a6406d to before 59eecf0ffde15670e6a5e10c47be67f73d843b20Affected 95118dd4edfec950898a00180c6f998df0a6406d to before 5fb69e1eeea9d6cba80517e9f058b56b34bc3a81Affected 95118dd4edfec950898a00180c6f998df0a6406d to before 7cadb03be37e761130edb153544fe0770a842b19Affected 95118dd4edfec950898a00180c6f998df0a6406d to before 1d0bdbfe3e91c11f0a704c52443a9446a10d699cAffected 95118dd4edfec950898a00180c6f998df0a6406d to before ea3cd36d7382d5f8309df04c275d20df139ed42cAffected 95118dd4edfec950898a00180c6f998df0a6406d to before b255531b27da336571411248c2a72a350662bd09Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

95118dd4edfec950898a00180c6f998df0a6406d to before 59eecf0ffde15670e6a5e10c47be67f73d843b20Affected
95118dd4edfec950898a00180c6f998df0a6406d to before 5fb69e1eeea9d6cba80517e9f058b56b34bc3a81Affected
95118dd4edfec950898a00180c6f998df0a6406d to before 7cadb03be37e761130edb153544fe0770a842b19Affected
95118dd4edfec950898a00180c6f998df0a6406d to before 1d0bdbfe3e91c11f0a704c52443a9446a10d699cAffected
95118dd4edfec950898a00180c6f998df0a6406d to before ea3cd36d7382d5f8309df04c275d20df139ed42cAffected
95118dd4edfec950898a00180c6f998df0a6406d to before b255531b27da336571411248c2a72a350662bd09Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.