HighFix available
Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.12.81, 6.18.22, 6.19.12, 6.6.143
- CVEs
- CVE-2026-43019
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 02:36 UTC · Revision 1
Source evidence
Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
core-osv · Original sourcePublished 1 May 2026, 14:15 UTC
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid "tearing" in the configuration.
osv:CVE-2026-43019
Kernel
Fixed versions: 6.6.143, 6.12.81, 6.18.22, 6.19.12
Complete source record
{
"id": "dbd867dfaf7df2dcfc47101d3e4e8578ca0092cb95425f2e7e7405781caa56de",
"url": "https://osv.dev/vulnerability/CVE-2026-43019",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync",
"summary": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync hci_conn lookup and field access must be covered by hdev lock in set_cig_params_sync, otherwise it's possible it is freed concurrently. Take hdev lock to prevent hci_conn from being deleted or modified concurrently. Just RCU lock is not suitable here, as we also want to avoid \"tearing\" in the configuration.",
"evidence": "osv:CVE-2026-43019",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.6.143",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.81",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.22",
"evidence": "/affected/1/ranges"
},
{
"value": "6.19.12",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-43019",
"aliases": [
"CVE-2026-43019"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a091289218202bc09d9b9caa8afcde1018584aec"
},
{
"fixed": "7502c1cf303b69f71d085f5ff7251b0e1b0f09df"
},
{
"fixed": "66d432e9b45bae7881ffcdb12cd8fd0bf254ef02"
},
{
"fixed": "7d568fede8eac91161a60b710aa920abe9b0fb9f"
},
{
"fixed": "bad65b4b0a96139f023eadc28a33125963208449"
},
{
"fixed": "a2639a7f0f5bf7d73f337f8f077c19415c62ed2c"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.4.16"
},
{
"fixed": "6.5"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.5.3"
},
{
"fixed": "6.6"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3a273cd0f47dd672d37736e623849374f9ab9ce9"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062"
}
]
}
],
"versions": [
"v6.4.16",
"v6.5.13",
"v6.5.12",
"v6.5.11",
"v6.5.10",
"v6.5.9",
"v6.5.8",
"v6.5.7",
"v6.5.6",
"v6.5.5",
"v6.5.4",
"v6.5.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43019.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.6.0"
},
{
"fixed": "6.6.143"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.81"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.22"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "6.19.12"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43019.json"
}
}
],
"modified": "2026-10-28T02:30:46.080105929Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/66d432e9b45bae7881ffcdb12cd8fd0bf254ef02",
"https://git.kernel.org/stable/c/7502c1cf303b69f71d085f5ff7251b0e1b0f09df",
"https://git.kernel.org/stable/c/7d568fede8eac91161a60b710aa920abe9b0fb9f",
"https://git.kernel.org/stable/c/a2639a7f0f5bf7d73f337f8f077c19415c62ed2c",
"https://git.kernel.org/stable/c/bad65b4b0a96139f023eadc28a33125963208449",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43019.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-43019",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43019.json"
}
},
"related_cves": [
{
"value": "CVE-2026-43019",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514333,
"published_at": "2026-05-01T14:15:23.035+00:00"
}