CVE-2026-46056
published 2026-05-27CVE-2026-46056: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field…
high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.
Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.
Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 92a25256f142d55e25f9959441cea6ddeabae57e < b6ae482f88654db407c8c17619d4b62959b903ef | b6ae482f88654db407c8c17619d4b62959b903ef |
| linux | linux | >= 92a25256f142d55e25f9959441cea6ddeabae57e < 204028af77a265e31ceb4ba7f643349a3cca72b2 | 204028af77a265e31ceb4ba7f643349a3cca72b2 |
| linux | linux | >= 92a25256f142d55e25f9959441cea6ddeabae57e < 01a6431766c35dfedb86e0cb5d3fc80c6d604a47 | 01a6431766c35dfedb86e0cb5d3fc80c6d604a47 |
| linux | linux | >= 92a25256f142d55e25f9959441cea6ddeabae57e < e08d75753db17aa943d7622f09d9c217b5bfd3b8 | e08d75753db17aa943d7622f09d9c217b5bfd3b8 |
| linux | linux | >= 92a25256f142d55e25f9959441cea6ddeabae57e < 8c6443bb9257b780986fb67ec08565bf48ecb8d7 | 8c6443bb9257b780986fb67ec08565bf48ecb8d7 |
| linux | linux | >= 92a25256f142d55e25f9959441cea6ddeabae57e < 85fa3512048793076eef658f66489112dcc91993 | 85fa3512048793076eef658f66489112dcc91993 |
| linux | linux_kernel | — | — |