CVE-2026-93209
Received Received - Intake

Bluetooth Timeout Due to skb_clone Failure in Linux Kernel

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb BT enable fails intermittently with -ETIMEDOUT (-110). The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG), but the waiter in __hci_cmd_sync_sk() never woke up and timed out after 10 s: bluetooth hci0: Opcode 0xfc00 // __hci_cmd_sync_sk bluetooth hci0: opcode 0xfc00 plen 1 // hci_cmd_sync_add bluetooth hci0: skb len 4 // hci_cmd_sync_alloc bluetooth hci0: length 1 // hci_req_sync_run Bluetooth: hci0 cmd_cnt 1 cmd queued 1 // hci_cmd_work Bluetooth: hci0 type 1 len 4 // hci_send_frame Bluetooth: opcode 0xfc00 status 0x00 // hci_req_cmd_complete <-- req_skb NULL: req_complete_skb not set, hci_cmd_sync_complete() never called, req_status stays HCI_REQ_PEND --> <-- 10 s later: wait_event_interruptible_timeout expires --> bluetooth hci0: end: err -110 // __hci_cmd_sync_sk The root cause is that hci_send_cmd_sync() clones the sent command into hdev->req_skb so that hci_req_cmd_complete() can locate the registered completion callback. Under memory pressure this skb_clone() fails, leaving hdev->req_skb NULL. The firmware reply is received and processed, but hci_req_cmd_complete() finds NULL req_skb, so hci_cmd_sync_complete() is never called, req_status stays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT. req_skb is only used to read bt_cb(skb)->hci callbacks and opcode -- it is never modified. Replace skb_clone() with skb_get(), which simply increments the reference count of hdev->sent_cmd without allocating new memory and therefore cannot fail. This issue was first observed as a use-after-free in ttyport_close() when ttyport_open() failed, which was investigated in an earlier patch series [1]. That investigation led to the discovery of the true root cause described above. [1] https://lore.kernel.org/all/20250430111617.1151390-1-quic_cxin@quicinc.com/

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93209
EUVD
EUVD-2026-85938

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects Bluetooth functionality. It occurs when the system fails to enable Bluetooth due to a timeout error (-ETIMEDOUT). The issue stems from a failed memory allocation during a command synchronization process. Specifically, the kernel attempts to clone a command buffer but fails under memory pressure, leaving a critical data structure null. This prevents the system from properly completing the Bluetooth enable process.

Detection Guidance

This vulnerability manifests as intermittent Bluetooth enable failures with -ETIMEDOUT errors in kernel logs. Check for messages like 'BT enable fails intermittently with -ETIMEDOUT' or 'waiter in __hci_cmd_sync_sk() never woke up' in system logs using commands like 'dmesg | grep -i bluetooth' or 'journalctl -k | grep -i bluetooth'.

Impact Analysis

This vulnerability can cause intermittent Bluetooth failure on Linux systems. Users may experience Bluetooth devices not enabling properly, leading to connectivity issues with peripherals like keyboards, headphones, or other Bluetooth-enabled hardware. The failure occurs unpredictably, often under memory pressure conditions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Bluetooth stack issue in the Linux kernel causing intermittent BT enable failures due to memory pressure during skb_clone(). No data exposure or privacy violation is described.

Mitigation Strategies

Update to a patched Linux kernel version that includes the fix for this issue. The vulnerability is resolved by replacing skb_clone() with skb_get() in the Bluetooth subsystem. Check your distribution's security updates or kernel release notes for the fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart