CVE-2026-43019

Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

Published May 1, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

hci_conn lookup and field access must be covered by hdev lock in
set_cig_params_sync, otherwise it's possible it is freed concurrently.

Take hdev lock to prevent hci_conn from being deleted or modified
concurrently. Just RCU lock is not suitable here, as we also want to
avoid "tearing" in the configuration.

Analysis

Technical impact

An unprotected use‑after‑free occurs in the Linux kernel’s Bluetooth stack when the set_cig_params_sync function accesses an hci_conn object without acquiring the necessary hdev lock. Because the object may be freed or modified concurrently, dereferencing it can corrupt kernel memory or trigger a crash. The vulnerability does not explicitly mention privilege escalation, but a kernel crash or memory corruption could allow arbitrary code execution from kernel space if a local exploit is crafted.

Affected Systems

All Linux kernel releases that contain the upstream Bluetooth implementation before the commits adding the hdev lock are vulnerable; this includes commonly shipped generic kernels such as 6.4.x, 6.5.x, and early 7.0 release candidates. Any distribution that distributes a kernel derived from those sources without applying the lock patch is at risk.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. The description does not specify the required attack vector; no public exploits have been reported. The overall risk is moderate due to the low EPSS and lack of known exploits.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a091289218202bc09d9b9caa8afcde1018584aec`	affected	< 7502c1cf303b69f71d085f5ff7251b0e1b0f09df
`a091289218202bc09d9b9caa8afcde1018584aec`	affected	< 66d432e9b45bae7881ffcdb12cd8fd0bf254ef02
`a091289218202bc09d9b9caa8afcde1018584aec`	affected	< 7d568fede8eac91161a60b710aa920abe9b0fb9f
`a091289218202bc09d9b9caa8afcde1018584aec`	affected	< bad65b4b0a96139f023eadc28a33125963208449
`a091289218202bc09d9b9caa8afcde1018584aec`	affected	< a2639a7f0f5bf7d73f337f8f077c19415c62ed2c
`3a273cd0f47dd672d37736e623849374f9ab9ce9`	affected	—
`d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062`	affected	—
`6.4.16`	affected	< 6.5
`6.5.3`	affected	< 6.6

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.6.143`	unaffected	≤ 6.6.*
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.4.16:::::::*
	cpe:2.3:o:linux:linux_kernel:6.5.3:::::::*
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[a091289218202bc09d9b9caa8afcde1018584aec,66d432e9b45bae7881ffcdb12cd8fd0bf254ef02)`	affected	code_commit	—
`[a091289218202bc09d9b9caa8afcde1018584aec,7d568fede8eac91161a60b710aa920abe9b0fb9f)`	affected	code_commit	—
`[a091289218202bc09d9b9caa8afcde1018584aec,bad65b4b0a96139f023eadc28a33125963208449)`	affected	code_commit	—
`[a091289218202bc09d9b9caa8afcde1018584aec,a2639a7f0f5bf7d73f337f8f077c19415c62ed2c)`	affected	code_commit	—
`3a273cd0f47dd672d37736e623849374f9ab9ce9`	affected	code_commit	—
`d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.6`	affected	semver	—
`[0,6.6)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version containing the commit that introduces the hdev lock around set_cig_params_sync, such as any kernel released after the referenced changes
If an immediate kernel upgrade is not possible, disable or unload the Bluetooth module to remove the attack surface
Continuously monitor vendor advisories, kernel mailing lists, and security bulletins for updates that address this issue and apply them as soon as they become available

Generated by OpenCVE AI on October 23, 2026 at 07:53 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.100% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/66d432e9b45bae7881ffcdb12cd8fd0bf254ef02
https://git.kernel.org/stable/c/7502c1cf303b69f71d085f5ff7251b0e1b0f09df
https://git.kernel.org/stable/c/7d568fede8eac91161a60b710aa920abe9b0fb9f
https://git.kernel.org/stable/c/a2639a7f0f5bf7d73f337f8f077c19415c62ed2c
https://git.kernel.org/stable/c/bad65b4b0a96139f023eadc28a33125963208449
https://lore.kernel.org/linux-cve-announce/2026050157-CVE-2026-43019-0c5c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43019
https://www.cve.org/CVERecord?id=CVE-2026-43019

History

Oct 19, 2026 8:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Oct 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 19, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7502c1cf303b69f71d085f5ff7251b0e1b0f09df

May 8, 2026 2:45 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:6.4.16:::::::* cpe:2.3:o:linux:linux_kernel:6.5.3:::::::* cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::

May 3, 2026 6:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

May 2, 2026 12:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

May 2, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://lore.kernel.org/linux-cve-announce/2026050157-CVE-2026-43019-0c5c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43019 https://www.cve.org/CVERecord?id=CVE-2026-43019
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

May 1, 2026 11:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

May 1, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.
Title		Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/66d432e9b45bae7881ffcdb12cd8fd0bf254ef02 https://git.kernel.org/stable/c/7d568fede8eac91161a60b710aa920abe9b0fb9f https://git.kernel.org/stable/c/a2639a7f0f5bf7d73f337f8f077c19415c62ed2c https://git.kernel.org/stable/c/bad65b4b0a96139f023eadc28a33125963208449

Earlier changes (4)

Subscriptions

Linux Linux Kernel

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-416
Use After Free
CWE-821
Incorrect Synchronization