CVE-2026-46056

Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

State: Published
Severity: 8.8 High
Published: May 27, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently.

Extend the hci_dev_lock critical section to cover all conn usage in both handlers.

Keep the existing keypress notification behavior unchanged by routing the early exits through a common unlock path.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	92a25256f142d55e25f9959441cea6ddeabae57e to before ea18732d2614557e59f4c0d8cdbe6611aeab33b7Affected 92a25256f142d55e25f9959441cea6ddeabae57e to before d28311539ac9f65e29308ea219ecaa48aa5e76e5Affected 92a25256f142d55e25f9959441cea6ddeabae57e to before b6ae482f88654db407c8c17619d4b62959b903efAffected 92a25256f142d55e25f9959441cea6ddeabae57e to before 204028af77a265e31ceb4ba7f643349a3cca72b2Affected 92a25256f142d55e25f9959441cea6ddeabae57e to before 01a6431766c35dfedb86e0cb5d3fc80c6d604a47Affected 92a25256f142d55e25f9959441cea6ddeabae57e to before e08d75753db17aa943d7622f09d9c217b5bfd3b8Affected 92a25256f142d55e25f9959441cea6ddeabae57e to before 8c6443bb9257b780986fb67ec08565bf48ecb8d7Affected 92a25256f142d55e25f9959441cea6ddeabae57e to before 85fa3512048793076eef658f66489112dcc91993Affected
LinuxLinux	3.7Affected before 3.7Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.86 through 6.12.Not affected 6.18.27 through 6.18.Not affected 7.0.4 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

92a25256f142d55e25f9959441cea6ddeabae57e to before ea18732d2614557e59f4c0d8cdbe6611aeab33b7Affected
92a25256f142d55e25f9959441cea6ddeabae57e to before d28311539ac9f65e29308ea219ecaa48aa5e76e5Affected
92a25256f142d55e25f9959441cea6ddeabae57e to before b6ae482f88654db407c8c17619d4b62959b903efAffected
92a25256f142d55e25f9959441cea6ddeabae57e to before 204028af77a265e31ceb4ba7f643349a3cca72b2Affected
92a25256f142d55e25f9959441cea6ddeabae57e to before 01a6431766c35dfedb86e0cb5d3fc80c6d604a47Affected
92a25256f142d55e25f9959441cea6ddeabae57e to before e08d75753db17aa943d7622f09d9c217b5bfd3b8Affected
92a25256f142d55e25f9959441cea6ddeabae57e to before 8c6443bb9257b780986fb67ec08565bf48ecb8d7Affected
92a25256f142d55e25f9959441cea6ddeabae57e to before 85fa3512048793076eef658f66489112dcc91993Affected

LinuxLinux

3.7Affected
before 3.7Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.86 through 6.12.*Not affected
6.18.27 through 6.18.*Not affected
7.0.4 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.