Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage in both handlers. Keep the existing keypress notification behavior unchanged by routing the early exits through a common unlock path.

Timeline

1. May 27, 2026, 12:57 PM UTCCVE published
2. Oct 16, 2026, 3:19 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 19, 2026, 7:26 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 92a25256f142d55e25f9959441cea6ddeabae57e · fixed in ea18732d2614557e59f4c0d8cdbe6611aeab33b7; From 92a25256f142d55e25f9959441cea6ddeabae57e · fixed in d28311539ac9f65e29308ea219ecaa48aa5e76e5; From 92a25256f142d55e25f9959441cea6ddeabae57e · fixed in b6ae482f88654db407c8c17619d4b62959b903ef; From 92a25256f142d55e25f9959441cea6ddeabae57e · fixed in 204028af77a265e31ceb4ba7f643349a3cca72b2; From 92a25256f142d55e25f9959441cea6ddeabae57e · fixed in 01a6431766c35dfedb86e0cb5d3fc80c6d604a47; From 92a25256f142d55e25f9959441cea6ddeabae57e · fixed in e08d75753db17aa943d7622f09d9c217b5bfd3b8; From 92a25256f142d55e25f9959441cea6ddeabae57e · fixed in 8c6443bb9257b780986fb67ec08565bf48ecb8d7; From 92a25256f142d55e25f9959441cea6ddeabae57e · fixed in 85fa3512048793076eef658f66489112dcc91993

• Linux Linux

  3.7

• KernelLinux

  From 3.7.0 · fixed in 5.10.259; From 5.11.0 · fixed in 5.15.210; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.140; From 6.7.0 · fixed in 6.12.86; From 6.13.0 · fixed in 6.18.27; From 6.19.0 · fixed in 7.0.4

References 8