CVE-2026-43019

Analyzed Analyzed - Analysis Complete

Bluetooth UAF Fix in Linux Kernel HCI Connection

Publication date: 2026-05-01

Last updated on: 2026-06-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-01

Last Modified

2026-06-19

Generated

2026-07-06

AI Q&A

2026-05-01

EPSS Evaluated

2026-07-05

NVD

CVE-2026-43019

EUVD

EUVD-2026-26618

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.13 (inc) to 6.18.22 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.12 (exc)
linux	linux_kernel	From 6.6 (inc) to 6.12.81 (exc)
linux	linux_kernel	6.4.16
linux	linux_kernel	6.5.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth subsystem, specifically in the function set_cig_params_sync within hci_conn. The issue is a potential Use-After-Free (UAF) condition caused by improper locking. The hci_conn lookup and field access are not properly protected by the hdev lock, which can lead to the hci_conn object being freed or modified concurrently. The fix involves taking the hdev lock to prevent concurrent deletion or modification, as relying only on RCU locking is insufficient to avoid inconsistent configuration states.

Impact Analysis

This vulnerability can lead to a Use-After-Free condition in the Bluetooth subsystem of the Linux kernel. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the concurrent modification or deletion of Bluetooth connection objects.

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the Bluetooth hci_conn use-after-free issue in set_cig_params_sync has been fixed.

Specifically, the fix involves taking the hdev lock to prevent concurrent deletion or modification of hci_conn, so applying the official kernel patch or upgrading to a patched kernel version is recommended.

Hi! I’m here to help you understand CVE-2026-43019. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70