Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-80692

Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c to < f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805affected
  • 881559af5f5c545f6828e7c74d79813eb886d523 to < 301a4e2e89313dee10f0e8cb084daedbbe4a3dceaffected
  • 881559af5f5c545f6828e7c74d79813eb886d523 to < a4de6fc95b2f36967fc247ae51cad2171194f7cdaffected
  • 881559af5f5c545f6828e7c74d79813eb886d523 to < 9a77f296aff4b2ca5f2928ab3a3220c82d8b4074affected
  • 881559af5f5c545f6828e7c74d79813eb886d523 to < 2f5d635ad5906b0235bc0c870e8beba3116e1e98affected
  • 5dd0bd277a0a936708a33ecc447dce77a08cbde6affected
  • 6.6.51 to < 6.6.160affected
  • 6.8.9 to < 6.9affected

Linux Linux

Default version status: affected

  • 6.9affected
  • 0 to < 6.9unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.1.8 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References