High · published May 27, 2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.
Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.
Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.7, < 6.1.175 | 6.1.175 |
| linux/linux_kernel | ≥ 6.2, < 6.6.140 | 6.6.140 |
| linux/linux_kernel | ≥ 6.7, < 6.12.86 | 6.12.86 |
| linux/linux_kernel | ≥ 6.13, < 6.18.27 | 6.18.27 |
| linux/linux_kernel | ≥ 6.19, < 7.0.4 | 7.0.4 |