https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 13:10:42 +0000 https://vulnerability.circl.lu/vuln/cve-2026-53072 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER</p> <p>When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev-&gt;lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -&gt; UAF.</p> <p>Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred listening socket code paths, hci_connect_cfm(conn) is called with hdev-&gt;lock held.</p> <p>Fix by holding the lock.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER</p> <p>When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev-&gt;lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -&gt; UAF.</p> <p>Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred listening socket code paths, hci_connect_cfm(conn) is called with hdev-&gt;lock held.</p> <p>Fix by holding the lock.</p> https://vulnerability.circl.lu/vuln/cve-2026-53072