CVE-2026-43119 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and organizations using Linux kernel versions 5.2 through 7.0-rc5 should apply patches to prevent potential data races in Bluetooth HCI synchronization. Security teams and vulnerability management teams should review and update their Linux kernel versions to prevent exposure to this vulnerability.

Technical summary

CVE-2026-43119 is a data race vulnerability in the Linux kernel's Bluetooth HCI synchronization. The __hci_cmd_sync_sk() function sets hdev->req_status under hdev->req_lock, but other functions like hci_send_cmd_sync(), hci_cmd_sync_complete(), hci_cmd_sync_cancel(), and hci_abort_conn() access hdev->req_status without holding any lock. This can lead to compiler optimizations affecting correctness. The issue was patched by adding READ_ONCE()/WRITE_ONCE() annotations to all concurrent accesses to hdev->req_status, ensuring that potential data races are prevented.

Defensive priority

Apply patches to prevent data races in Bluetooth HCI synchronization. Review and update Linux kernel versions 5.2 through 7.0-rc5. Monitor Linux kernel security advisories for future updates.

Recommended defensive actions

• Apply patches from Linux kernel stable branches
• Review and update Linux kernel versions 5.2 through 7.0-rc5
• Monitor Linux kernel security advisories for future updates
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-06T10:16:25.773Z and last modified on 2026-07-24T15:17:19.827Z. The NVD entry is currently Modified. This vulnerability affects Linux kernel versions 5.2 through 7.0-rc5. The issue was resolved by adding READ_ONCE()/WRITE_ONCE() annotations to all concurrent accesses to hdev->req_status. Evidence limits suggest that Linux kernel maintainers and distribution vendors should verify patch application and review Linux kernel security advisories for future updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.