CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
Bluetooth: fix locking in hciconnrequestevt() with HCIPROTODEFER
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
Hold hdev->lock in hci_conn_request_evt() before calling hci_connect_cfm(conn), including the HCI_PROTO_DEFER listening-socket path, to prevent concurrent connection deletion and use-after-free.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53072?
The severity of CVE-2026-53072 is rated at 40.
How do I fix CVE-2026-53072?
To fix CVE-2026-53072, ensure that the locking in hci_conn_request_evt() correctly holds hdev->lock during calls to hci_connect_cfm().
What systems are affected by CVE-2026-53072?
CVE-2026-53072 affects the Linux kernel and any systems utilizing Bluetooth features that depend on the affected version.
What are the potential impacts of CVE-2026-53072?
CVE-2026-53072 could lead to potential denial of service or instability in Bluetooth connections.
When was CVE-2026-53072 published?
CVE-2026-53072 was published on June 24, 2026.