CVE-2026-80692

Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

State: Published
Severity: 8.8 High
Published: Aug 28, 2026
Updated: Oct 21, 2026
Reserved: Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c to before f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805Affected 881559af5f5c545f6828e7c74d79813eb886d523 to before 301a4e2e89313dee10f0e8cb084daedbbe4a3dceAffected 881559af5f5c545f6828e7c74d79813eb886d523 to before a4de6fc95b2f36967fc247ae51cad2171194f7cdAffected 881559af5f5c545f6828e7c74d79813eb886d523 to before 9a77f296aff4b2ca5f2928ab3a3220c82d8b4074Affected 881559af5f5c545f6828e7c74d79813eb886d523 to before 2f5d635ad5906b0235bc0c870e8beba3116e1e98Affected 5dd0bd277a0a936708a33ecc447dce77a08cbde6Affected 6.6.51 to before 6.6.160Affected 6.8.9 to before 6.9Affected
LinuxLinux	6.9Affected before 6.9Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.1.8 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c to before f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805Affected
881559af5f5c545f6828e7c74d79813eb886d523 to before 301a4e2e89313dee10f0e8cb084daedbbe4a3dceAffected
881559af5f5c545f6828e7c74d79813eb886d523 to before a4de6fc95b2f36967fc247ae51cad2171194f7cdAffected
881559af5f5c545f6828e7c74d79813eb886d523 to before 9a77f296aff4b2ca5f2928ab3a3220c82d8b4074Affected
881559af5f5c545f6828e7c74d79813eb886d523 to before 2f5d635ad5906b0235bc0c870e8beba3116e1e98Affected
5dd0bd277a0a936708a33ecc447dce77a08cbde6Affected
6.6.51 to before 6.6.160Affected
6.8.9 to before 6.9Affected

LinuxLinux

6.9Affected
before 6.9Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.