CVE-2026-46275: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
Bluetooth: hciuart: fix UAFs and race conditions in close and init paths
Other sources
In the Linux kernel, the following vulnerability has been resolved:
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.2.6-1Fixed in 7.2.7-1 - Compensating control
In hci_uart close and error paths, clear HCI_UART_PROTO_READY and immediately use cancel_work_sync(&hu->write_work) before invoking hci_uart_flush(); use cancel_work_sync() rather than disable_work_sync() so protocol timers cannot requeue write_work and user-space retry remains possible.
- Compensating control
Invoke hu->proto->close(hu) strictly before hci_free_dev(hdev) across all close and initialization-error paths.
- Compensating control
Take the proto_lock write lock before clearing PROTO_READY, and keep the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section.
- Compensating control
Ensure hci_uart_tty_close() tears down the init_ready and write_work workqueues even when setup has not completed or HCI_UART_PROTO_READY is not set.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46275?
The severity of CVE-2026-46275 is rated at 57, indicating a moderate risk.
How do I fix CVE-2026-46275?
To fix CVE-2026-46275, ensure that your Linux kernel is updated to the latest stable version that includes the security patches.
What types of vulnerabilities are associated with CVE-2026-46275?
CVE-2026-46275 is associated with Use After Free (UAF) and Race Condition vulnerabilities.
What components of Linux are affected by CVE-2026-46275?
CVE-2026-46275 affects the Bluetooth hci_uart component of the Linux kernel.
When was CVE-2026-46275 published?
CVE-2026-46275 was published on June 8, 2026.