SB20260507249 - Race condition in Linux kernel bluetooth

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-43119)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a data race in hdev->req_status handling in the Bluetooth hci_sync subsystem when processing concurrent command synchronization operations across workqueues and event completion paths. A local user can trigger concurrent operations to cause a denial of service.

The issue arises because accesses occur from different workqueues and completion or abort paths that can run concurrently on different CPUs.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/40734ce8efc34c4a0d0222855798c0dc14b65f2e
• https://git.kernel.org/stable/c/6e539907c0d11f514c5e0b049b27b04dff48a5b1
• https://git.kernel.org/stable/c/a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27
• https://git.kernel.org/stable/c/b6807cfc195ef99e1ac37b2e1e60df40295daa8c