Home

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage.

PUBLISHED Reserved 2026-05-01 | Published 2026-05-01 | Updated 2026-05-03 | Assigner Linux




HIGH: 8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Product status

Default status
unaffected

95118dd4edfec950898a00180c6f998df0a6406d (git) before 59eecf0ffde15670e6a5e10c47be67f73d843b20
affected

95118dd4edfec950898a00180c6f998df0a6406d (git) before 5fb69e1eeea9d6cba80517e9f058b56b34bc3a81
affected

95118dd4edfec950898a00180c6f998df0a6406d (git) before 7cadb03be37e761130edb153544fe0770a842b19
affected

95118dd4edfec950898a00180c6f998df0a6406d (git) before 1d0bdbfe3e91c11f0a704c52443a9446a10d699c
affected

95118dd4edfec950898a00180c6f998df0a6406d (git) before ea3cd36d7382d5f8309df04c275d20df139ed42c
affected

95118dd4edfec950898a00180c6f998df0a6406d (git) before b255531b27da336571411248c2a72a350662bd09
affected

Default status
affected

5.17
affected

Any version before 5.17
unaffected

6.1.168 (semver)
unaffected

6.6.134 (semver)
unaffected

6.12.81 (semver)
unaffected

6.18.22 (semver)
unaffected

6.19.12 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/59eecf0ffde15670e6a5e10c47be67f73d843b20

git.kernel.org/...c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81

git.kernel.org/...c/7cadb03be37e761130edb153544fe0770a842b19

git.kernel.org/...c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c

git.kernel.org/...c/ea3cd36d7382d5f8309df04c275d20df139ed42c

git.kernel.org/...c/b255531b27da336571411248c2a72a350662bd09

cve.org (CVE-2026-43018)

nvd.nist.gov (CVE-2026-43018)

Download JSON