HarborGuard / CVE
Back to search
HIGHCVE-2026-43018Published Modified CNA Linux

CVE-2026-43018: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage.

Metrics

CVSS v3.1
8.8
Severity
HIGH
Fixed in
0
Affected Products
2

Fix available

01d0bdbfe3e91c11f0a704c52443a9446a10d699c59eecf0ffde15670e6a5e10c47be67f73d843b205fb69e1eeea9d6cba80517e9f058b56b34bc3a816.1.1686.6.1346.12.816.18.226.19.127.07cadb03be37e761130edb153544fe0770a842b19b255531b27da336571411248c2a72a350662bd09ea3cd36d7382d5f8309df04c275d20df139ed42c
Affected packages
  • Linux / Linux
    < 59eecf0ffde15670e6a5e10c47be67f73d843b20 (from 95118dd4edfec950898a00180c6f998df0a6406d) · < 5fb69e1eeea9d6cba80517e9f058b56b34bc3a81 (from 95118dd4edfec950898a00180c6f998df0a6406d) · < 7cadb03be37e761130edb153544fe0770a842b19 (from 95118dd4edfec950898a00180c6f998df0a6406d) · < 1d0bdbfe3e91c11f0a704c52443a9446a10d699c (from 95118dd4edfec950898a00180c6f998df0a6406d) · < ea3cd36d7382d5f8309df04c275d20df139ed42c (from 95118dd4edfec950898a00180c6f998df0a6406d) · < b255531b27da336571411248c2a72a350662bd09 (from 95118dd4edfec950898a00180c6f998df0a6406d)
  • Linux / Linux
    5.17
    Fixed in 0, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References