---
id: CVE-2026-43019
title: 'Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

  hci_conn lookup and field access must be covered by hdev lock in
  set_cig_params_sync, otherwise it's poss…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a091289218202bc09d9b9caa8afcde1018584aec <
    7502c1cf303b69f71d085f5ff7251b0e1b0f09df
  - >-
    Linux >= a091289218202bc09d9b9caa8afcde1018584aec <
    66d432e9b45bae7881ffcdb12cd8fd0bf254ef02
  - >-
    Linux >= a091289218202bc09d9b9caa8afcde1018584aec <
    7d568fede8eac91161a60b710aa920abe9b0fb9f
  - >-
    Linux >= a091289218202bc09d9b9caa8afcde1018584aec <
    bad65b4b0a96139f023eadc28a33125963208449
  - >-
    Linux >= a091289218202bc09d9b9caa8afcde1018584aec <
    a2639a7f0f5bf7d73f337f8f077c19415c62ed2c
  - Linux 3a273cd0f47dd672d37736e623849374f9ab9ce9
  - Linux d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062
  - Linux >= 6.4.16 < 6.5
  - Linux >= 6.5.3 < 6.6
  - Linux 6.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:13:33.625290Z'
published: '2026-05-01'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:28.210Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43019'
references:
  - url: 'https://git.kernel.org/stable/c/7502c1cf303b69f71d085f5ff7251b0e1b0f09df'
  - url: 'https://git.kernel.org/stable/c/66d432e9b45bae7881ffcdb12cd8fd0bf254ef02'
  - url: 'https://git.kernel.org/stable/c/7d568fede8eac91161a60b710aa920abe9b0fb9f'
  - url: 'https://git.kernel.org/stable/c/bad65b4b0a96139f023eadc28a33125963208449'
  - url: 'https://git.kernel.org/stable/c/a2639a7f0f5bf7d73f337f8f077c19415c62ed2c'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06538
ingestedAt: '2026-10-16T17:24:46.676Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync

hci_conn lookup and field access must be covered by hdev lock in
set_cig_params_sync, otherwise it's possible it is freed concurrently.

Take hdev lock to prevent hci_conn from being deleted or modified
concurrently.  Just RCU lock is not suitable here, as we also want to
avoid "tearing" in the configuration.

## Affected

- `Linux >= a091289218202bc09d9b9caa8afcde1018584aec < 7502c1cf303b69f71d085f5ff7251b0e1b0f09df`
- `Linux >= a091289218202bc09d9b9caa8afcde1018584aec < 66d432e9b45bae7881ffcdb12cd8fd0bf254ef02`
- `Linux >= a091289218202bc09d9b9caa8afcde1018584aec < 7d568fede8eac91161a60b710aa920abe9b0fb9f`
- `Linux >= a091289218202bc09d9b9caa8afcde1018584aec < bad65b4b0a96139f023eadc28a33125963208449`
- `Linux >= a091289218202bc09d9b9caa8afcde1018584aec < a2639a7f0f5bf7d73f337f8f077c19415c62ed2c`
- `Linux 3a273cd0f47dd672d37736e623849374f9ab9ce9`
- `Linux d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062`
- `Linux >= 6.4.16 < 6.5`
- `Linux >= 6.5.3 < 6.6`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.