CVE-2026-43119
Race Condition in Linux Kernel Bluetooth Subsystem
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability involves data races in the Linux kernel Bluetooth hci_sync code related to concurrent access to hdev->req_status without proper locking.
To mitigate this vulnerability, update your Linux kernel to a version where this issue is resolved by adding READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses to hdev->req_status.
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's Bluetooth subsystem involves a data race condition around the variable hdev->req_status. The function __hci_cmd_sync_sk() sets this variable while holding a lock, but several other functions read or write to it without any locking. Since these functions run on different workqueues that can execute concurrently on different CPUs, the unsynchronized access leads to a data race.
The issue arises because concurrent accesses to hdev->req_status are not properly synchronized, which can cause incorrect behavior due to compiler optimizations like load fusing or store reordering. The fix involved adding READ_ONCE()/WRITE_ONCE() annotations to all concurrent accesses to ensure correct memory access ordering.
How can this vulnerability impact me? :
This vulnerability can lead to unpredictable behavior in the Bluetooth subsystem of the Linux kernel due to data races on the hdev->req_status variable. Such data races can cause incorrect synchronization, potentially resulting in failures or instability in Bluetooth command processing.
While the exact impact is not detailed, data races can cause erratic system behavior, crashes, or security issues if exploited, affecting the reliability and stability of Bluetooth communications on affected systems.