CVE-2026-43019

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently.

Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416CWE-362

Affected software

VendorProductVersions
LinuxLinux>= a091289218202bc09d9b9caa8afcde1018584aec, < 7502c1cf303b69f71d085f5ff7251b0e1b0f09df; >= a091289218202bc09d9b9caa8afcde1018584aec, < 66d432e9b45bae7881ffcdb12cd8fd0bf254ef02; >= a091289218202bc09d9b9caa8afcde1018584aec, < 7d568fede8eac91161a60b710aa920abe9b0fb9f; >= a091289218202bc09d9b9caa8afcde1018584aec, < bad65b4b0a96139f023eadc28a33125963208449; >= a091289218202bc09d9b9caa8afcde1018584aec, < a2639a7f0f5bf7d73f337f8f077c19415c62ed2c; 3a273cd0f47dd672d37736e623849374f9ab9ce9; d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062; >= 6.4.16, < 6.5; >= 6.5.3, < 6.6
LinuxLinux6.6

References

Timeline

Published
May 1, 2026
Last modified
Nov 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-43027.2The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1CVE-2026-430207.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stoCVE-2026-430215.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails WhenCVE-2026-430225.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if existsCVE-2026-430237.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_conCVE-2026-430245.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is aCVE-2026-430257.3In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use tCVE-2026-430265.5In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absentCVE-2026-430277.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntCVE-2026-430287.1In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names thatCVE-2026-430297.5In the Linux kernel, the following vulnerability has been resolved: mptcp: fix soft lockup in mptcp_recvmsg() syzbot reported a soft lockuCVE-2026-43036.4The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wsm_showDa
CVE-2026-43019: High severity, CVSS 7.8 | Vulnix