PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43322 Git CVE debrief

CVE-2026-43322 is a Linux kernel Bluetooth memory-safety issue in hci_sync. The supplied record shows a use-after-free in le_read_features_complete involving hci_conn lifetime handling, with NVD rating the issue 8.8 High and an adjacent attack vector. Kernel.org stable references indicate the flaw has been fixed upstream and backported in stable trees.

Vendor
Git
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-11
Advisory published
2026-05-08
Advisory updated
2026-05-11

Who should care

Linux kernel maintainers, distribution security teams, and operators of systems that have Bluetooth enabled should treat this as high priority. Fleets with exposed or routinely used Bluetooth functionality have the most direct exposure.

Technical summary

The issue is described as a race where hci_conn can be freed after hci_le_read_remote_features_sync returns but before le_read_features_complete runs. Because of that timing, hci_conn_del and hci_cmd_sync_dequeue do not reliably prevent the callback from touching freed memory. The supplied KASAN trace shows a slab-use-after-free in hci_conn_drop reached from le_read_features_complete, and the allocation/free paths point to hci_conn allocation in __hci_conn_add and release via device_release/kobject_cleanup.

Defensive priority

High. Prioritize kernel updates on any system using Bluetooth, especially production hosts and fleet images that can receive nearby Bluetooth traffic.

Recommended defensive actions

  • Apply the vendor or stable kernel updates that include the fix referenced by the kernel.org stable commits.
  • Update all Linux distributions and custom kernels that include the affected Bluetooth hci_sync code.
  • Reboot systems after patching so the running kernel is replaced by the fixed version.
  • Track distro and kernel security advisories for backported fixes if you do not build kernels from upstream sources.

Evidence notes

The CVE description includes a KASAN report showing slab-use-after-free in le_read_features_complete, with the call trace reaching hci_conn_drop. The record also states the flaw occurs after hci_le_read_remote_features_sync and before le_read_features_complete, and it provides two kernel.org stable reference URLs that appear to correspond to the fixes/backports. NVD metadata lists CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43322 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43322

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43322 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43322

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/035c25007c9e698bef3826070ee34bb6d778020c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/260dc2be643b4a35b27008490c533613e3e53867

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.