CVE-2026-43018 (GCVE-0-2026-43018)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-08-05 12:25
VLAI
Title
Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 95118dd4edfec950898a00180c6f998df0a6406d , < 59eecf0ffde15670e6a5e10c47be67f73d843b20 (git)
Affected: 95118dd4edfec950898a00180c6f998df0a6406d , < 5fb69e1eeea9d6cba80517e9f058b56b34bc3a81 (git)
Affected: 95118dd4edfec950898a00180c6f998df0a6406d , < 7cadb03be37e761130edb153544fe0770a842b19 (git)
Affected: 95118dd4edfec950898a00180c6f998df0a6406d , < 1d0bdbfe3e91c11f0a704c52443a9446a10d699c (git)
Affected: 95118dd4edfec950898a00180c6f998df0a6406d , < ea3cd36d7382d5f8309df04c275d20df139ed42c (git)
Affected: 95118dd4edfec950898a00180c6f998df0a6406d , < b255531b27da336571411248c2a72a350662bd09 (git)
Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.6.134 , ≤ 6.6.* (semver)
Unaffected: 6.12.81 , ≤ 6.12.* (semver)
Unaffected: 6.18.22 , ≤ 6.18.* (semver)
Unaffected: 6.19.12 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "59eecf0ffde15670e6a5e10c47be67f73d843b20",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "5fb69e1eeea9d6cba80517e9f058b56b34bc3a81",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "7cadb03be37e761130edb153544fe0770a842b19",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "1d0bdbfe3e91c11f0a704c52443a9446a10d699c",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "ea3cd36d7382d5f8309df04c275d20df139ed42c",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            },
            {
              "lessThan": "b255531b27da336571411248c2a72a350662bd09",
              "status": "affected",
              "version": "95118dd4edfec950898a00180c6f998df0a6406d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_le_remote_conn_param_req_evt, otherwise it\u0027s possible it is freed\nconcurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable handler processes an LE Remote Connection Parameter Request generated from Bluetooth LE link-layer traffic, so an attacker must be within Bluetooth radio range. This is adjacent-network reachability rather than IP network or local syscall access.\nAC:L - A nearby attacker can establish or use an LE connection and send connection-parameter requests, with teardown/race timing repeatable and attacker-influenced. There is no rare configuration or condition beyond normal LE controller support for this event.\nPR:N - The path is reached from Bluetooth controller events caused by a remote peer and does not require local OS privileges. The LE connection parameter request is not gated on pairing or authenticated kernel credentials.\nUI:N - In a reasonable BLE deployment where the target is connectable or accepts LE connections, the attacker can trigger the event without victim interaction. No file opening, mounting, or explicit user action is required.\nS:U - The bug is in the host kernel Bluetooth stack and impacts the same kernel security authority. It does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - This is a kernel use-after-free of an hci_conn object, with stale fields read after the object may have been freed and reused. Conservatively, kernel UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - A kernel heap UAF can be exploited through object reuse and heap shaping to corrupt data or control flow. Under the required conservative scoring, this supports high integrity impact.\nA:H - Even without full exploitation, dereferencing a freed hci_conn can cause a kernel oops or panic. Repeated adjacent Bluetooth triggering can therefore produce high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:17.496Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09"
        }
      ],
      "title": "Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43018",
    "datePublished": "2026-05-01T14:15:22.308Z",
    "dateReserved": "2026-05-01T14:12:55.975Z",
    "dateUpdated": "2026-08-05T12:25:17.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43018",
      "date": "2026-08-08",
      "epss": "0.00256",
      "percentile": "0.17154"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43018\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T15:16:45.980\",\"lastModified\":\"2026-06-17T10:48:46.497\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt\\n\\nhci_conn lookup and field access must be covered by hdev lock in\\nhci_le_remote_conn_param_req_evt, otherwise it\u0027s possible it is freed\\nconcurrently.\\n\\nExtend the hci_dev_lock critical section to cover all conn usage.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/hci_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"95118dd4edfec950898a00180c6f998df0a6406d\",\"lessThan\":\"59eecf0ffde15670e6a5e10c47be67f73d843b20\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"95118dd4edfec950898a00180c6f998df0a6406d\",\"lessThan\":\"5fb69e1eeea9d6cba80517e9f058b56b34bc3a81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"95118dd4edfec950898a00180c6f998df0a6406d\",\"lessThan\":\"7cadb03be37e761130edb153544fe0770a842b19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"95118dd4edfec950898a00180c6f998df0a6406d\",\"lessThan\":\"1d0bdbfe3e91c11f0a704c52443a9446a10d699c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"95118dd4edfec950898a00180c6f998df0a6406d\",\"lessThan\":\"ea3cd36d7382d5f8309df04c275d20df139ed42c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"95118dd4edfec950898a00180c6f998df0a6406d\",\"lessThan\":\"b255531b27da336571411248c2a72a350662bd09\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/hci_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.168\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.134\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.81\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.22\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.12\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"6.1.168\",\"matchCriteriaId\":\"3AC7ECFB-6178-47EB-B821-2568DE6BFF85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.134\",\"matchCriteriaId\":\"F56F925B-BAF8-4F4B-B62F-1496AF19A307\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.81\",\"matchCriteriaId\":\"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.22\",\"matchCriteriaId\":\"C9DF8BCE-36D3-475D-9D21-19E4F02F9029\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.12\",\"matchCriteriaId\":\"0A2B9540-02D5-41B4-B16A-82AF66FD4F36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T12:49:22+00:00",
      "cve": "CVE-2026-43018",
      "id": "CVE-2026-43018",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43018.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-22T00:04:08Z",
      "cve": "CVE-2026-43018",
      "id": "CVE-2026-43018",
      "initial_release_date": "2026-05-06T01:41:22Z",
      "product_status:known_affected": "78",
      "product_status:known_not_affected": "156",
      "product_status:recommended": "98",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43018",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43018.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.