CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade debian/linux to a version that resolves this vulnerability.

   Fixed in 6.12.85-1
2. Upgrade

   Upgrade debian/linux to a version that resolves this vulnerability.

   Fixed in 6.19.14-1
3. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 6.1.191
4. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 6.6.145
5. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 6.12.83
6. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 6.18.24
7. Upgrade

   Upgrade linux/Kernel to a version that resolves this vulnerability.

   Fixed in 6.19.14
8. Upgrade

   Upgrade debian/linux to a version that resolves this vulnerability.

   Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
9. Upgrade

   Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

   Fixed in 6.8.0-1061.64~22.04.1
10. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71~22.04.1
11. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69~22.04.1
12. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72~22.04.1
13. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136~22.04.1
14. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.62~22.04.1
15. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136.2~22.04.1
16. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62~22.04.1
17. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61~22.04.1
18. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136~22.04.3
19. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1056.57~22.04.2
20. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136
21. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.64
22. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71
23. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69
24. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72
25. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.67
26. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1046.50
27. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.62
28. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136.2
29. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62
30. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62.1
31. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1030.31
32. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61
33. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.65
34. Upgrade

    Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.

    Fixed in 6.8.0-1008.8
35. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1033.34
36. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.33
37. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2050.52
38. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1056.57
39. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.64+fips1
40. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71+fips2
41. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136+fips2
42. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72+fips1
43. Configuration

    Add READ_ONCE()/WRITE_ONCE() annotations to all concurrent reads and writes of hdev->req_status, including accesses in hci_abort_conn(), hci_cmd_sync_cancel(), hci_cmd_sync_cancel_sync(), hci_cmd_sync_complete(), and hci_send_cmd_sync(), to prevent compiler optimizations such as load fusing and store reordering.

    Linux Bluetooth hci_sync hdev->req_status concurrent accesses = READ_ONCE()/WRITE_ONCE() annotations

Event History

Frequently Asked Questions