Skip to content
Heist/ feed
Back to feed
HighFix available

Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.258, 5.15.209, 6.1.175, 6.12.92, 6.18.34, 6.6.142, 7.0.11
CVEs
CVE-2026-46275
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 02:27 UTC · Revision 1

Source evidence

Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

core-osv · Original source

Published 8 Jun 2026, 14:30 UTC

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and

osv:CVE-2026-46275

Kernel

Fixed versions: 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11

Complete source record
{
  "id": "6b1851a4c236839baeafbd27c266612c8da23c5d4021d0a57ce48ea94146ca7b",
  "url": "https://osv.dev/vulnerability/CVE-2026-46275",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and",
    "evidence": "osv:CVE-2026-46275",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.258",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.209",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.175",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.142",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.92",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.34",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.0.11",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-46275",
      "aliases": [
        "CVE-2026-46275"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "3b799254cf6f481460719023d7a18f46651e5e7f"
                },
                {
                  "fixed": "78aad93e938f013d9272fe0ee168f27883afa95c"
                },
                {
                  "fixed": "e2d19969c8d9198ecc3090bcd5312ecd503a3339"
                },
                {
                  "fixed": "c85cff648a2bc92322912db5f1727ad05afae7b6"
                },
                {
                  "fixed": "9d20d48be2c4a071fb015eb09bda2cecd25daf34"
                },
                {
                  "fixed": "81c7a3c22a0f2808cf4ae0b4908f59763b23606d"
                },
                {
                  "fixed": "192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894"
                },
                {
                  "fixed": "7338031946bd06f6dff149e67b60c4cd083bfea8"
                },
                {
                  "fixed": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "4.14.203"
                },
                {
                  "fixed": "4.15"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "4.19.153"
                },
                {
                  "fixed": "4.20"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.4.73"
                },
                {
                  "fixed": "5.5"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.8.17"
                },
                {
                  "fixed": "5.9"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.9.2"
                },
                {
                  "fixed": "5.10"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "cd27019bc149f20f12ebec943c2b4c775745a5a0"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "aea63181b6fcb6b9ccde1ada9ea51be19c4015af"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0d234d1135dcd8876de0576dac68efd0a87eef87"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "3fe978892ab46efc2f3830d9abc015eff72caaf9"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f"
                }
              ]
            }
          ],
          "versions": [
            "v4.14.336",
            "v4.14.335",
            "v4.14.334",
            "v4.14.333",
            "v4.14.332",
            "v4.14.331",
            "v4.14.330",
            "v4.14.329",
            "v4.14.328",
            "v4.14.327",
            "v4.14.326",
            "v4.14.325",
            "v4.14.324",
            "v4.14.323",
            "v4.14.322",
            "v4.14.321",
            "v4.14.320",
            "v4.14.319",
            "v4.14.318",
            "v4.14.317",
            "v4.14.316",
            "v4.14.315",
            "v4.14.314",
            "v4.14.313",
            "v4.14.312",
            "v4.14.311",
            "v4.14.310",
            "v4.14.309",
            "v4.14.308",
            "v4.14.307",
            "v4.14.306",
            "v4.14.305",
            "v4.14.304",
            "v4.14.303",
            "v4.14.302",
            "v4.14.301",
            "v4.14.300",
            "v4.14.299",
            "v4.14.298",
            "v4.14.297",
            "v4.14.296",
            "v4.14.295",
            "v4.14.294",
            "v4.14.293",
            "v4.14.292",
            "v4.14.291",
            "v4.14.290",
            "v4.14.289",
            "v4.14.288",
            "v4.14.287",
            "v4.14.286",
            "v4.14.285",
            "v4.14.284",
            "v4.14.283",
            "v4.14.282",
            "v4.14.281",
            "v4.14.280",
            "v4.14.279",
            "v4.14.278",
            "v4.14.277",
            "v4.14.276",
            "v4.14.275",
            "v4.14.274",
            "v4.14.273",
            "v4.14.272",
            "v4.14.271",
            "v4.14.270",
            "v4.14.269",
            "v4.14.268",
            "v4.14.267",
            "v4.14.266",
            "v4.14.265",
            "v4.14.264",
            "v4.14.263",
            "v4.14.262",
            "v4.14.261",
            "v4.14.260",
            "v4.14.259",
            "v4.14.258",
            "v4.14.257",
            "v4.14.256",
            "v4.14.255",
            "v4.14.254",
            "v4.14.253",
            "v4.14.252",
            "v4.14.251",
            "v4.14.250",
            "v4.14.249",
            "v4.14.248",
            "v4.14.247",
            "v4.14.246",
            "v4.14.245",
            "v4.14.244",
            "v4.14.243",
            "v4.14.242",
            "v4.14.241",
            "v4.14.240",
            "v4.14.239",
            "v4.14.238",
            "v4.14.237",
            "v4.14.236",
            "v4.14.235",
            "v4.14.234",
            "v4.14.233",
            "v4.14.232",
            "v4.14.231",
            "v4.14.230",
            "v4.14.229",
            "v4.14.228",
            "v4.14.227",
            "v4.14.226",
            "v4.14.225",
            "v4.14.224",
            "v4.14.223",
            "v4.14.222",
            "v4.14.221",
            "v4.14.220",
            "v4.14.219",
            "v4.14.218",
            "v4.14.217",
            "v4.14.216",
            "v4.14.215",
            "v4.14.214",
            "v4.14.213",
            "v4.14.212",
            "v4.14.211",
            "v4.14.210",
            "v4.14.209",
            "v4.14.208",
            "v4.14.207",
            "v4.14.206",
            "v4.14.205",
            "v4.14.204",
            "v4.14.203",
            "v4.19.325",
            "v4.19.324",
            "v4.19.323",
            "v4.19.322",
            "v4.19.321",
            "v4.19.320",
            "v4.19.319",
            "v4.19.318",
            "v4.19.317",
            "v4.19.316",
            "v4.19.315",
            "v4.19.314",
            "v4.19.313",
            "v4.19.312",
            "v4.19.311",
            "v4.19.310",
            "v4.19.309",
            "v4.19.308",
            "v4.19.307",
            "v4.19.306",
            "v4.19.305",
            "v4.19.304",
            "v4.19.303",
            "v4.19.302",
            "v4.19.301",
            "v4.19.300",
            "v4.19.299",
            "v4.19.298",
            "v4.19.297",
            "v4.19.296",
            "v4.19.295",
            "v4.19.294",
            "v4.19.293",
            "v4.19.292",
            "v4.19.291",
            "v4.19.290",
            "v4.19.289",
            "v4.19.288",
            "v4.19.287",
            "v4.19.286",
            "v4.19.285",
            "v4.19.284",
            "v4.19.283",
            "v4.19.282",
            "v4.19.281",
            "v4.19.280",
            "v4.19.279",
            "v4.19.278",
            "v4.19.277",
            "v4.19.276",
            "v4.19.275",
            "v4.19.274",
            "v4.19.273",
            "v4.19.272",
            "v4.19.271",
            "v4.19.270",
            "v4.19.269",
            "v4.19.268",
            "v4.19.267",
            "v4.19.266",
            "v4.19.265",
            "v4.19.264",
            "v4.19.263",
            "v4.19.262",
            "v4.19.261",
            "v4.19.260",
            "v4.19.259",
            "v4.19.258",
            "v4.19.257",
            "v4.19.256",
            "v4.19.255",
            "v4.19.254",
            "v4.19.253",
            "v4.19.252",
            "v4.19.251",
            "v4.19.250",
            "v4.19.249",
            "v4.19.248",
            "v4.19.247",
            "v4.19.246",
            "v4.19.245",
            "v4.19.244",
            "v4.19.243",
            "v4.19.242",
            "v4.19.241",
            "v4.19.240",
            "v4.19.239",
            "v4.19.238",
            "v4.19.237",
            "v4.19.236",
            "v4.19.235",
            "v4.19.234",
            "v4.19.233",
            "v4.19.232",
            "v4.19.231",
            "v4.19.230",
            "v4.19.229",
            "v4.19.228",
            "v4.19.227",
            "v4.19.226",
            "v4.19.225",
            "v4.19.224",
            "v4.19.223",
            "v4.19.222",
            "v4.19.221",
            "v4.19.220",
            "v4.19.219",
            "v4.19.218",
            "v4.19.217",
            "v4.19.216",
            "v4.19.215",
            "v4.19.214",
            "v4.19.213",
            "v4.19.212",
            "v4.19.211",
            "v4.19.210",
            "v4.19.209",
            "v4.19.208",
            "v4.19.207",
            "v4.19.206",
            "v4.19.205",
            "v4.19.204",
            "v4.19.203",
            "v4.19.202",
            "v4.19.201",
            "v4.19.200",
            "v4.19.199",
            "v4.19.198",
            "v4.19.197",
            "v4.19.196",
            "v4.19.195",
            "v4.19.194",
            "v4.19.193",
            "v4.19.192",
            "v4.19.191",
            "v4.19.190",
            "v4.19.189",
            "v4.19.188",
            "v4.19.187",
            "v4.19.186",
            "v4.19.185",
            "v4.19.184",
            "v4.19.183",
            "v4.19.182",
            "v4.19.181",
            "v4.19.180",
            "v4.19.179",
            "v4.19.178",
            "v4.19.177",
            "v4.19.176",
            "v4.19.175",
            "v4.19.174",
            "v4.19.173",
            "v4.19.172",
            "v4.19.171",
            "v4.19.170",
            "v4.19.169",
            "v4.19.168",
            "v4.19.167",
            "v4.19.166",
            "v4.19.165",
            "v4.19.164",
            "v4.19.163",
            "v4.19.162",
            "v4.19.161",
            "v4.19.160",
            "v4.19.159",
            "v4.19.158",
            "v4.19.157",
            "v4.19.156",
            "v4.19.155",
            "v4.19.154",
            "v4.19.153",
            "v5.4.302",
            "v5.4.301",
            "v5.4.300",
            "v5.4.299",
            "v5.4.298",
            "v5.4.297",
            "v5.4.296",
            "v5.4.295",
            "v5.4.294",
            "v5.4.293",
            "v5.4.292",
            "v5.4.291",
            "v5.4.290",
            "v5.4.289",
            "v5.4.288",
            "v5.4.287",
            "v5.4.286",
            "v5.4.285",
            "v5.4.284",
            "v5.4.283",
            "v5.4.282",
            "v5.4.281",
            "v5.4.280",
            "v5.4.279",
            "v5.4.278",
            "v5.4.277",
            "v5.4.276",
            "v5.4.275",
            "v5.4.274",
            "v5.4.273",
            "v5.4.272",
            "v5.4.271",
            "v5.4.270",
            "v5.4.269",
            "v5.4.268",
            "v5.4.267",
            "v5.4.266",
            "v5.4.265",
            "v5.4.264",
            "v5.4.263",
            "v5.4.262",
            "v5.4.261",
            "v5.4.260",
            "v5.4.259",
            "v5.4.258",
            "v5.4.257",
            "v5.4.256",
            "v5.4.255",
            "v5.4.254",
            "v5.4.253",
            "v5.4.252",
            "v5.4.251",
            "v5.4.250",
            "v5.4.249",
            "v5.4.248",
            "v5.4.247",
            "v5.4.246",
            "v5.4.245",
            "v5.4.244",
            "v5.4.243",
            "v5.4.242",
            "v5.4.241",
            "v5.4.240",
            "v5.4.239",
            "v5.4.238",
            "v5.4.237",
            "v5.4.236",
            "v5.4.235",
            "v5.4.234",
            "v5.4.233",
            "v5.4.232",
            "v5.4.231",
            "v5.4.230",
            "v5.4.229",
            "v5.4.228",
            "v5.4.227",
            "v5.4.226",
            "v5.4.225",
            "v5.4.224",
            "v5.4.223",
            "v5.4.222",
            "v5.4.221",
            "v5.4.220",
            "v5.4.219",
            "v5.4.218",
            "v5.4.217",
            "v5.4.216",
            "v5.4.215",
            "v5.4.214",
            "v5.4.213",
            "v5.4.212",
            "v5.4.211",
            "v5.4.210",
            "v5.4.209",
            "v5.4.208",
            "v5.4.207",
            "v5.4.206",
            "v5.4.205",
            "v5.4.204",
            "v5.4.203",
            "v5.4.202",
            "v5.4.201",
            "v5.4.200",
            "v5.4.199",
            "v5.4.198",
            "v5.4.197",
            "v5.4.196",
            "v5.4.195",
            "v5.4.194",
            "v5.4.193",
            "v5.4.192",
            "v5.4.191",
            "v5.4.190",
            "v5.4.189",
            "v5.4.188",
            "v5.4.187",
            "v5.4.186",
            "v5.4.185",
            "v5.4.184",
            "v5.4.183",
            "v5.4.182",
            "v5.4.181",
            "v5.4.180",
            "v5.4.179",
            "v5.4.178",
            "v5.4.177",
            "v5.4.176",
            "v5.4.175",
            "v5.4.174",
            "v5.4.173",
            "v5.4.172",
            "v5.4.171",
            "v5.4.170",
            "v5.4.169",
            "v5.4.168",
            "v5.4.167",
            "v5.4.166",
            "v5.4.165",
            "v5.4.164",
            "v5.4.163",
            "v5.4.162",
            "v5.4.161",
            "v5.4.160",
            "v5.4.159",
            "v5.4.158",
            "v5.4.157",
            "v5.4.156",
            "v5.4.155",
            "v5.4.154",
            "v5.4.153",
            "v5.4.152",
            "v5.4.151",
            "v5.4.150",
            "v5.4.149",
            "v5.4.148",
            "v5.4.147",
            "v5.4.146",
            "v5.4.145",
            "v5.4.144",
            "v5.4.143",
            "v5.4.142",
            "v5.4.141",
            "v5.4.140",
            "v5.4.139",
            "v5.4.138",
            "v5.4.137",
            "v5.4.136",
            "v5.4.135",
            "v5.4.134",
            "v5.4.133",
            "v5.4.132",
            "v5.4.131",
            "v5.4.130",
            "v5.4.129",
            "v5.4.128",
            "v5.4.127",
            "v5.4.126",
            "v5.4.125",
            "v5.4.124",
            "v5.4.123",
            "v5.4.122",
            "v5.4.121",
            "v5.4.120",
            "v5.4.119",
            "v5.4.118",
            "v5.4.117",
            "v5.4.116",
            "v5.4.115",
            "v5.4.114",
            "v5.4.113",
            "v5.4.112",
            "v5.4.111",
            "v5.4.110",
            "v5.4.109",
            "v5.4.108",
            "v5.4.107",
            "v5.4.106",
            "v5.4.105",
            "v5.4.104",
            "v5.4.103",
            "v5.4.102",
            "v5.4.101",
            "v5.4.100",
            "v5.4.99",
            "v5.4.98",
            "v5.4.97",
            "v5.4.96",
            "v5.4.95",
            "v5.4.94",
            "v5.4.93",
            "v5.4.92",
            "v5.4.91",
            "v5.4.90",
            "v5.4.89",
            "v5.4.88",
            "v5.4.87",
            "v5.4.86",
            "v5.4.85",
            "v5.4.84",
            "v5.4.83",
            "v5.4.82",
            "v5.4.81",
            "v5.4.80",
            "v5.4.79",
            "v5.4.78",
            "v5.4.77",
            "v5.4.76",
            "v5.4.75",
            "v5.4.74",
            "v5.4.73",
            "v5.8.18",
            "v5.8.17",
            "v5.9.16",
            "v5.9.15",
            "v5.9.14",
            "v5.9.13",
            "v5.9.12",
            "v5.9.11",
            "v5.9.10",
            "v5.9.9",
            "v5.9.8",
            "v5.9.7",
            "v5.9.6",
            "v5.9.5",
            "v5.9.4",
            "v5.9.3",
            "v5.9.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46275.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.10.0"
                },
                {
                  "fixed": "5.10.258"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.209"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.175"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.142"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.92"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.34"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.0.11"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46275.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:45.933930056Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
        "https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",
        "https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8",
        "https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c",
        "https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d",
        "https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34",
        "https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",
        "https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6",
        "https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46275.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-46275",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46275.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-46275",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 514268,
  "published_at": "2026-06-08T14:30:54.232+00:00"
}