CVE-2026-43019

Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

State: Published
Severity: 7.8 High
Published: May 1, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently.

Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	a091289218202bc09d9b9caa8afcde1018584aec to before 7502c1cf303b69f71d085f5ff7251b0e1b0f09dfAffected a091289218202bc09d9b9caa8afcde1018584aec to before 66d432e9b45bae7881ffcdb12cd8fd0bf254ef02Affected a091289218202bc09d9b9caa8afcde1018584aec to before 7d568fede8eac91161a60b710aa920abe9b0fb9fAffected a091289218202bc09d9b9caa8afcde1018584aec to before bad65b4b0a96139f023eadc28a33125963208449Affected a091289218202bc09d9b9caa8afcde1018584aec to before a2639a7f0f5bf7d73f337f8f077c19415c62ed2cAffected 3a273cd0f47dd672d37736e623849374f9ab9ce9Affected d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062Affected 6.4.16 to before 6.5Affected 6.5.3 to before 6.6Affected
LinuxLinux	6.6Affected before 6.6Not affected 6.6.143 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

a091289218202bc09d9b9caa8afcde1018584aec to before 7502c1cf303b69f71d085f5ff7251b0e1b0f09dfAffected
a091289218202bc09d9b9caa8afcde1018584aec to before 66d432e9b45bae7881ffcdb12cd8fd0bf254ef02Affected
a091289218202bc09d9b9caa8afcde1018584aec to before 7d568fede8eac91161a60b710aa920abe9b0fb9fAffected
a091289218202bc09d9b9caa8afcde1018584aec to before bad65b4b0a96139f023eadc28a33125963208449Affected
a091289218202bc09d9b9caa8afcde1018584aec to before a2639a7f0f5bf7d73f337f8f077c19415c62ed2cAffected
3a273cd0f47dd672d37736e623849374f9ab9ce9Affected
d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062Affected
6.4.16 to before 6.5Affected
6.5.3 to before 6.6Affected

LinuxLinux

6.6Affected
before 6.6Not affected
6.6.143 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.