CVE-2026-93209: Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Bluetooth: hcicore: use skbget() instead of skbclone() for reqskb
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What operational symptom indicates this issue may be present?
Bluetooth enable can fail intermittently with -ETIMEDOUT (-110). The timeout occurs after the HCI command completion waiter is not awakened, despite firmware reporting status 0x00 for the command.
What log messages can help identify an affected failure?
The reported sequence includes an HCI command such as "Opcode 0xfc00", a successful "opcode 0xfc00 status 0x00" response, followed roughly 10 seconds later by "end: err -110". This combination indicates that the command response was received but synchronous command completion did not occur.
What condition contributes to the failure?
The described root cause involves cloning the sent command into hdev->req_skb. Under memory pressure, the clone operation can prevent the completion callback from being found, leaving the request pending until it times out.