CVE-2026-43018: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcievent: fix potential UAF in hcileremoteconnparamreqevt
hciconn lookup and field access must be covered by hdev lock in hcileremoteconnparamreqevt, otherwise it's possible it is freed concurrently.
Extend the hcidevlock critical section to cover all conn usage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Extend the hci_dev_lock critical section in hci_le_remote_conn_param_req_evt to cover the hci_conn lookup and all conn field accesses, preventing concurrent freeing.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43018?
CVE-2026-43018 has a moderate severity rating due to its potential to lead to use-after-free vulnerabilities.
How do I fix CVE-2026-43018?
To fix CVE-2026-43018, update your Linux kernel to the latest version that contains the patch addressing this vulnerability.
What is the impact of CVE-2026-43018 on my system?
The impact of CVE-2026-43018 can include potential crashes or unauthorized access due to exploitation of the use-after-free condition.
Which versions of the Linux kernel are affected by CVE-2026-43018?
CVE-2026-43018 affects specific versions of the Linux kernel that handle Bluetooth connections, particularly those not updated with the latest patches.
Is CVE-2026-43018 exploitable remotely?
Yes, CVE-2026-43018 can be exploited remotely through Bluetooth connections, making it a potential risk for users of affected devices.