Skip to main content

Linux Kernel EUVDEUVD-2026-38940

| CVE-2026-53072 HIGH
Improper Locking (CWE-667)
2026-06-24 Linux GHSA-h99j-gm55-rrcw
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

AV:A for Bluetooth proximity; AC:H because exploitation depends on winning a concurrent conn-deletion race; PR:N/UI:N as the remote peer needs no auth, and a kernel UAF yields full C/I/A impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:04 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF.

Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred listening socket code paths, hci_connect_cfm(conn) is called with hdev->lock held.

Fix by holding the lock.

AnalysisAI

Use-after-free in the Linux kernel Bluetooth subsystem allows kernel memory corruption when the HCI connection-request handler (hci_conn_request_evt()) invokes hci_connect_cfm() without holding hdev->lock under the HCI_PROTO_DEFER path. An adjacent attacker within Bluetooth range can race a concurrent connection teardown against a deferred-setup SCO listener to free and reuse the conn object, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), reflecting the narrow, race-dependent trigger rather than broad exploitability.

Technical ContextAI

The flaw lives in the Bluetooth HCI event layer of the kernel (net/bluetooth/hci_event.c). When a protocol enables HCI_PROTO_DEFER - used only by SCO and ISO for deferred setup on listening sockets - the inbound HCI_EV_CONN_REQUEST handler calls hci_connect_cfm(conn) to notify upper layers without taking hdev->lock, even though hci_connect_cfm() and the surrounding connection state machine generally assume that device lock is held. If the conn structure is concurrently torn down (e.g., the connection is deleted on another path), the notification operates on freed memory. This is a classic concurrency/locking defect (root cause is CWE-416 Use-After-Free arising from a missing lock / CWE-667-style improper locking, even though the feed lists CWE as N/A). Per the description, only the SCO defer-setup listen path is actually reachable, because HCI_EV_CONN_REQUEST is not generated for ISO, and the non-deferred socket paths already call hci_connect_cfm() with hdev->lock held. The CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e., the mainline Linux kernel, with the fix bounded by stable commit ranges.

RemediationAI

Apply your distribution's updated kernel package; the upstream fix simply takes hdev->lock around the hci_connect_cfm() call in hci_conn_request_evt(). Vendor-released patch: upgrade to 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or your distro's backport carrying one of the stable commits listed at https://git.kernel.org/stable/c/, e.g. c7777f534a8018ae4bb1c80d8925af4df588a314). If immediate patching is not possible, the most effective compensating control is to disable the Bluetooth stack where it is not needed - unload the relevant modules (e.g. rmmod bluetooth / blacklist via modprobe) or power down the radio (rfkill block bluetooth) - which closes the adjacent attack surface entirely at the cost of losing Bluetooth audio/SCO functionality. Where Bluetooth must remain enabled, restrict device pairing/discoverability and avoid running SCO services configured for deferred setup, and keep hosts out of untrusted RF proximity; these reduce the chance of an attacker initiating the connection request that drives the race but do not eliminate the bug. Refer to the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-53072) and your distro's security tracker for the exact backported package version.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

Share

EUVD-2026-38940 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy