CVE-2026-43022
Bluetooth: hci_cmd_sync_queue_once() Race Condition in Linux Kernel
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth subsystem, specifically in the function hci_cmd_sync_queue_once(). The function did not properly indicate whether a queue item was added, which could cause the caller to be unaware if callbacks were called, potentially leading to resource leaks.
The fix changes the function to return -EEXIST if the queue item already exists, allowing the caller to handle this case properly and avoid leaking resources.
How can this vulnerability impact me? :
If exploited or triggered, this vulnerability could cause resource leaks in the Bluetooth subsystem of the Linux kernel. Resource leaks may degrade system performance or stability over time, potentially leading to crashes or denial of service conditions.