CVE-2026-80692

HighCVSS 8.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

There is theoretical UAF if the conn is freed while the hci_sync task is running.

Hold refcount to avoid that.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c, < f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805; >= 881559af5f5c545f6828e7c74d79813eb886d523, < 301a4e2e89313dee10f0e8cb084daedbbe4a3dce; >= 881559af5f5c545f6828e7c74d79813eb886d523, < a4de6fc95b2f36967fc247ae51cad2171194f7cd; >= 881559af5f5c545f6828e7c74d79813eb886d523, < 9a77f296aff4b2ca5f2928ab3a3220c82d8b4074; >= 881559af5f5c545f6828e7c74d79813eb886d523, < 2f5d635ad5906b0235bc0c870e8beba3116e1e98; 5dd0bd277a0a936708a33ecc447dce77a08cbde6; >= 6.6.51, < 6.6.160; >= 6.8.9, < 6.9
LinuxLinux6.9

References

Timeline

Published
Aug 28, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-806939.3In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpfCVE-2026-806949.8In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_contrCVE-2026-80695In the Linux kernel, the following vulnerability has been resolved: hwmon: (sht3x) Fix unaligned accesses Sashiko reports: In sht3x_updatCVE-2026-806967.8In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Fix reading the minimum alarm voltage Coverity reportCVE-2026-80697In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid f_path for page cache sharing Previously, backing CVE-2026-80698In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The CVE-2026-80699In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested contextCVE-2026-80707.3Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, reCVE-2026-807007.8In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmwCVE-2026-80701In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmw_cursor_planCVE-2026-807027.8In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size Two siteCVE-2026-80703In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE