In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.

Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.

Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
92a25256f142d55e25f9959441cea6ddeabae57e affected < 204028af77a265e31ceb4ba7f643349a3cca72b2
92a25256f142d55e25f9959441cea6ddeabae57e affected < 01a6431766c35dfedb86e0cb5d3fc80c6d604a47
92a25256f142d55e25f9959441cea6ddeabae57e affected < e08d75753db17aa943d7622f09d9c217b5bfd3b8
92a25256f142d55e25f9959441cea6ddeabae57e affected < 8c6443bb9257b780986fb67ec08565bf48ecb8d7
92a25256f142d55e25f9959441cea6ddeabae57e affected < 85fa3512048793076eef658f66489112dcc91993
Linux Linux affected
Version Status Constraints
3.7 affected —
0 unaffected < 3.7
6.6.140 unaffected ≤ 6.6.*
6.12.86 unaffected ≤ 6.12.*
6.18.27 unaffected ≤ 6.18.*
7.0.4 unaffected ≤ 7.0.*
7.1-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47 cve-icon cve-icon
https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2 cve-icon cve-icon
https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993 cve-icon cve-icon
https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7 cve-icon cve-icon
https://git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8 cve-icon cve-icon
History

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage in both handlers. Keep the existing keypress notification behavior unchanged by routing the early exits through a common unlock path.
Title Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-27T12:57:15.150Z

Reserved: 2026-05-13T15:03:33.094Z

Link: CVE-2026-46056

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:25.317

Modified: 2026-05-27T14:48:03.013

Link: CVE-2026-46056

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.