What’s Vulnerable › Vulnerabilities

CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-01 · updated 2026-10-19
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.

Affected products

• Linux kernel: from 6.6 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 6.4.16, 6.5.3, 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4 (+2) — fixed in 6.12.81, 6.18.22, 6.19.12

How to fix

Upgrade to a fixed version: Linux kernel 6.12.81, 6.18.22, 6.19.12. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/66d432e9b45bae7881ffcdb12cd8fd0bf254ef02
• https://git.kernel.org/stable/c/7502c1cf303b69f71d085f5ff7251b0e1b0f09df
• https://git.kernel.org/stable/c/7d568fede8eac91161a60b710aa920abe9b0fb9f
• https://git.kernel.org/stable/c/a2639a7f0f5bf7d73f337f8f077c19415c62ed2c
• https://git.kernel.org/stable/c/bad65b4b0a96139f023eadc28a33125963208449

Get alerted when CVE-2026-43019 or the next vulnerability affects your stack