CVE-2026-43018 (GCVE-0-2026-43018)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage.
References
Impacted products
Vendor Product Version
Linux Linux Version: 95118dd4edfec950898a00180c6f998df0a6406d
Version: 95118dd4edfec950898a00180c6f998df0a6406d
Version: 95118dd4edfec950898a00180c6f998df0a6406d
Version: 95118dd4edfec950898a00180c6f998df0a6406d
Version: 95118dd4edfec950898a00180c6f998df0a6406d
Version: 95118dd4edfec950898a00180c6f998df0a6406d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "59eecf0ffde15670e6a5e10c47be67f73d843b20",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "5fb69e1eeea9d6cba80517e9f058b56b34bc3a81",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "7cadb03be37e761130edb153544fe0770a842b19",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "1d0bdbfe3e91c11f0a704c52443a9446a10d699c",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "ea3cd36d7382d5f8309df04c275d20df139ed42c",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "b255531b27da336571411248c2a72a350662bd09",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_le_remote_conn_param_req_evt, otherwise it\u0027s possible it is freed\nconcurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable handler processes an LE Remote Connection Parameter Request generated from Bluetooth LE link-layer traffic, so an attacker must be within Bluetooth radio range. This is adjacent-network reachability rather than IP network or local syscall access.\nAC:L - A nearby attacker can establish or use an LE connection and send connection-parameter requests, with teardown/race timing repeatable and attacker-influenced. There is no rare configuration or condition beyond normal LE controller support for this event.\nPR:N - The path is reached from Bluetooth controller events caused by a remote peer and does not require local OS privileges. The LE connection parameter request is not gated on pairing or authenticated kernel credentials.\nUI:N - In a reasonable BLE deployment where the target is connectable or accepts LE connections, the attacker can trigger the event without victim interaction. No file opening, mounting, or explicit user action is required.\nS:U - The bug is in the host kernel Bluetooth stack and impacts the same kernel security authority. It does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - This is a kernel use-after-free of an hci_conn object, with stale fields read after the object may have been freed and reused. Conservatively, kernel UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - A kernel heap UAF can be exploited through object reuse and heap shaping to corrupt data or control flow. Under the required conservative scoring, this supports high integrity impact.\nA:H - Even without full exploitation, dereferencing a freed hci_conn can cause a kernel oops or panic. Repeated adjacent Bluetooth triggering can therefore produce high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:17.496Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09"
        }
      ],
      "title": "Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43018",
    "datePublished": "2026-05-01T14:15:22.308Z",
    "dateReserved": "2026-05-01T14:12:55.975Z",
    "dateUpdated": "2026-08-05T12:25:17.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.