PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46056 Linux CVE debrief

A use-after-free (UAF) vulnerability exists in the Linux kernel's Bluetooth subsystem, specifically within the Simple Secure Pairing (SSP) passkey event handlers. The flaw affects `hci_user_passkey_notify_evt()` and `hci_keypress_notify_evt()` functions in `net/bluetooth/hci_event.c`. Without proper synchronization, the `hci_conn` connection object can be freed by a concurrent thread while these handlers are still accessing it, leading to memory corruption and potential privilege escalation or system instability. The vulnerability stems from insufficient locking coverage: the `hci_dev_lock` was not held during all phases of connection lookup and field access. The fix extends the critical section to encompass all `conn` usage in both handlers, ensuring thread-safe access to connection state during SSP passkey negotiations.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

Linux system administrators, embedded/IoT device manufacturers using Bluetooth connectivity, kernel maintainers, security teams managing Bluetooth-enabled endpoints, and organizations with bring-your-own-device policies where Bluetooth pairing occurs

Technical summary

The vulnerability is a race condition in Bluetooth Host Controller Interface (HCI) event handling. During Simple Secure Pairing (SSP) passkey notification and keypress notification events, the kernel performs `hci_conn` lookups and accesses connection fields without holding the `hci_dev_lock` for the entire operation window. This creates a race window where a concurrent operation (e.g., connection teardown, timeout, or error handling) can free the connection object, resulting in use-after-free when the original handler continues execution. The fix consolidates locking to ensure `hci_dev_lock` is held across all connection access paths, with careful handling of early exit paths to preserve existing keypress notification semantics.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits once available for your distribution
  • Verify Bluetooth kernel module (bluetooth, btusb, hci_uart) versions match patched releases
  • Monitor system logs for Bluetooth-related crashes or warnings that may indicate exploitation attempts
  • Consider disabling Bluetooth or restricting pairing to trusted devices on critical systems until patching is complete
  • Review kernel crash dumps for use-after-free signatures in hci_event.c if instability is observed

Evidence notes

The vulnerability description explicitly identifies the affected functions (`hci_user_passkey_notify_evt` and `hci_keypress_notify_evt`) and the root cause (missing `hdev` lock coverage during `hci_conn` operations). Five kernel.org stable tree commits are provided as references, indicating backports to multiple kernel versions. The fix pattern—extending `hci_dev_lock` critical sections—is a standard defensive synchronization approach for HCI connection lifecycle management.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46056 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46056

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46056 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46056

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.