CVE-2026-43019CWE-362CWE-416

CVE-2026-43019

High · published May 1, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
2.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

hci_conn lookup and field access must be covered by hdev lock in

set_cig_params_sync, otherwise it's possible it is freed concurrently.

Take hdev lock to prevent hci_conn from being deleted or modified

concurrently. Just RCU lock is not suitable here, as we also want to

avoid "tearing" in the configuration.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00135 · 2.7th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2026-05-01T19:16Z
Affected products (11)
ProductVersionsFixed in
linux/linux_kernel≥ 6.6, < 6.12.816.12.81
linux/linux_kernel≥ 6.13, < 6.18.226.18.22
linux/linux_kernel≥ 6.19, < 6.19.126.19.12
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
https://git.kernel.org/stable/c/66d432e9b45bae7881ffcdb12cd8fd0bf254ef02 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7502c1cf303b69f71d085f5ff7251b0e1b0f09df · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7d568fede8eac91161a60b710aa920abe9b0fb9f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a2639a7f0f5bf7d73f337f8f077c19415c62ed2c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bad65b4b0a96139f023eadc28a33125963208449 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 01 MAY 14:15Z
    Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
    cvelistv5