PT-2026-44234 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46111

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci conn: fix potential UAF in create big sync

Add hci conn valid() check in create big sync() to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in create big complete() and re-validate the connection under hci dev lock() before dereferencing, matching the pattern used by create le conn complete() and create pa complete().

Keep the hci conn object alive across the async boundary by taking a reference via hci conn get() when queueing create big sync(), and dropping it in the completion callback. The refcount and the lock are complementary: the refcount keeps the object allocated, while hci dev lock() serializes hci conn hash del()'s list del rcu() on hdev->conn hash, as required by hci conn del().

hci conn put() is called outside hci dev unlock() so the final put (which resolves to kfree() via bt link release) does not run under hdev->lock, though the release path would be safe either way.

Without this, create big complete() would unconditionally dereference the conn pointer on error, causing a use-after-free via hci connect cfm() and hci conn del().

Fix

Related Identifiers

CVE-2026-46111

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46111 · Security Note
• https://git.kernel.org/stable/c/f8eaf92c57ad99358dd372580d5ff87623343a72 · Note
• https://git.kernel.org/stable/c/6823f730bf195fc296d9edd09e2ca94bc1ff5584 · Note
• https://git.kernel.org/stable/c/0beddb0c380bed5f5b8e61ddbe14635bb73d0b41 · Note
• https://git.kernel.org/stable/c/dc34f8d8240f25dd137dc2758ebbcc75e3779142 · Note
• https://git.kernel.org/stable/c/1750a2df0eab61dc421a7afae74abdd239a44b85 · Note