CVE-2026-43019Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
- 7.8HighCVSS base score
- 0.10%Exploitation in 30 daysEPSS · top 99% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.
Timeline
ID reserved
By Linux
Published
- 6 months later
· 6 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.10% · top 99% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected a091289218202bc09d9b9caa8afcde1018584aec – < 7502c1cf303b69f71d085f5ff7251b0e1b0f09df
- affected a091289218202bc09d9b9caa8afcde1018584aec – < 66d432e9b45bae7881ffcdb12cd8fd0bf254ef02
- affected a091289218202bc09d9b9caa8afcde1018584aec – < 7d568fede8eac91161a60b710aa920abe9b0fb9f
- affected a091289218202bc09d9b9caa8afcde1018584aec – < bad65b4b0a96139f023eadc28a33125963208449
- affected a091289218202bc09d9b9caa8afcde1018584aec – < a2639a7f0f5bf7d73f337f8f077c19415c62ed2c
- affected 3a273cd0f47dd672d37736e623849374f9ab9ce9
- affected d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062
- affected 6.4.16 – < 6.5
- affected 6.5.3 – < 6.6
- affected 6.6
- unaffected < 6.6
- unaffected 6.6.143 – ≤ 6.6.*
- unaffected 6.12.81 – ≤ 6.12.*
- unaffected 6.18.22 – ≤ 6.18.*
- unaffected 6.19.12 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References5
- https://git.kernel.org/stable/c/7502c1cf303b69f71d085f5ff7251b0e1b0f09df (opens in a new tab)
- https://git.kernel.org/stable/c/66d432e9b45bae7881ffcdb12cd8fd0bf254ef02 (opens in a new tab)
- https://git.kernel.org/stable/c/7d568fede8eac91161a60b710aa920abe9b0fb9f (opens in a new tab)
- https://git.kernel.org/stable/c/bad65b4b0a96139f023eadc28a33125963208449 (opens in a new tab)
- https://git.kernel.org/stable/c/a2639a7f0f5bf7d73f337f8f077c19415c62ed2c (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-26618 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-43019)Record last updated .