High 8.8Published May 1, 2026

CVE-2026-43018Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt

Updated under an hour ago (Oct 27, 2026, 6:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	95118dd4edfec950898a00180c6f998df0a6406d builds before 59eecf0ffde15670e6a5e10c47be67f73d843b20; 95118dd4edfec950898a00180c6f998df0a6406d builds before 5fb69e1eeea9d6cba80517e9f058b56b34bc3a81; 95118dd4edfec950898a00180c6f998df0a6406d builds before 7cadb03be37e761130edb153544fe0770a842b19; 95118dd4edfec950898a00180c6f998df0a6406d builds before 1d0bdbfe3e91c11f0a704c52443a9446a10d699c; from 95118dd4edfec950898a00180c6f998df0a6406d before ea3cd36d7382d5f8309df04c275d20df139ed42c; from 95118dd4edfec950898a00180c6f998df0a6406d before b255531b27da336571411248c2a72a350662bd09	CNA record
linux linux_kernel linux:linux_kernel	from 5.17 before 6.1.168; from 6.2 before 6.6.134; from 6.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0; 7.0; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20	patch
https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81	patch
https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19	patch
https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c	patch
https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42c	patch
https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.