CVE-2026-53072
published 2026-06-24CVE-2026-53072: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets…
PriorityP343high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.25%
16.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls
hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm()
assumes it is held, and if conn is deleted concurrently -> UAF.
Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,
and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred
listening socket code paths, hci_connect_cfm(conn) is called with
hdev->lock held.
Fix by holding the lock.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 70c464256310e1c3716099b9d02ece4169272f73 < 60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4 | 60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4 |
| linux | linux | >= 70c464256310e1c3716099b9d02ece4169272f73 < 9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e | 9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e |
| linux | linux | >= 70c464256310e1c3716099b9d02ece4169272f73 < c7777f534a8018ae4bb1c80d8925af4df588a314 | c7777f534a8018ae4bb1c80d8925af4df588a314 |
| linux | linux | >= 70c464256310e1c3716099b9d02ece4169272f73 < 6b4d226d01ab7da0d2027a2a1e3a6079152e5065 | 6b4d226d01ab7da0d2027a2a1e3a6079152e5065 |
| linux | linux | >= 70c464256310e1c3716099b9d02ece4169272f73 < 541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f | 541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f |
| linux | linux | >= 70c464256310e1c3716099b9d02ece4169272f73 < 385b2d0468a0871fc716c549fa3b0c257c7dbcb3 | 385b2d0468a0871fc716c549fa3b0c257c7dbcb3 |
| linux | linux | >= 70c464256310e1c3716099b9d02ece4169272f73 < c27224daf0b08efbb2b24ed64b6139b294f5473a | c27224daf0b08efbb2b24ed64b6139b294f5473a |
| linux | linux | >= 70c464256310e1c3716099b9d02ece4169272f73 < 5c7209a341ff2ac338b2b0375c34a307b37c9ac2 | 5c7209a341ff2ac338b2b0375c34a307b37c9ac2 |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-53072 [MEDIUM] CWE-364 kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
A flaw was found in the Linux kernel's Bluetooth subsystem. Improper handling of locking within the `hci_conn_request_evt()` function, particularly when the `HCI_PROTO_DEFER` protocol is active, can result in a Use-After-Free (UAF) vulnerability. This condition arises when a connection object is accessed after it has been deallocated, potentially allowing a local attacker to cause a system crash or execute arbitrary code.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux
VulDB
Linux Kernel up to 7.0.9 Bluetooth hci_conn_request_evt lock use after free
vuldb·2026-06-24
CVE-2026-53072 [CRITICAL] Linux Kernel up to 7.0.9 Bluetooth hci_conn_request_evt lock use after free
A vulnerability was found in Linux Kernel up to 7.0.9. It has been classified as critical. This affects the function hci_conn_request_evt of the component Bluetooth. This manipulation of the argument lock causes use after free.
This vulnerability is handled as CVE-2026-53072. The attack can only be done within the local network. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() c
ghsa_unreviewed·2026-06-24
CVE-2026-53072 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() c
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls
hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm()
assumes it is held, and if conn is deleted concurrently -> UAF.
Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,
and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred
listening socket code paths, hci_connect_cfm(conn) is called with
hdev->lock held.
Fix by holding the lock.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801fhttps://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176ehttps://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473ahttps://git.kernel.org/stable/c/c7777f534a8018ae4bb1c80d8925af4df588a314
2026-06-24
Published