CVE-2026-46111

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix potential UAF in create_big_sync

Add hci_conn_valid() check in create_big_sync() to detect stale

connections before proceeding with BIG creation. Handle the

resulting -ECANCELED in create_big_complete() and re-validate the

connection under hci_dev_lock() before dereferencing, matching the

pattern used by create_le_conn_complete() and create_pa_complete().

Keep the hci_conn object alive across the async boundary by taking

a reference via hci_conn_get() when queueing create_big_sync(), and

dropping it in the completion callback. The refcount and the lock

are complementary: the refcount keeps the object allocated, while

hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on

hdev->conn_hash, as required by hci_conn_del().

hci_conn_put() is called outside hci_dev_unlock() so the final put

(which resolves to kfree() via bt_link_release) does not run under

hdev->lock, though the release

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References