In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls
hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm()
assumes it is held, and if conn is deleted concurrently -> UAF.

Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,
and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred
listening socket code paths, hci_connect_cfm(conn) is called with
hdev->lock held.

Fix by holding the lock.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
70c464256310e1c3716099b9d02ece4169272f73 affected < 60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4
70c464256310e1c3716099b9d02ece4169272f73 affected < 9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e
70c464256310e1c3716099b9d02ece4169272f73 affected < c7777f534a8018ae4bb1c80d8925af4df588a314
70c464256310e1c3716099b9d02ece4169272f73 affected < 6b4d226d01ab7da0d2027a2a1e3a6079152e5065
70c464256310e1c3716099b9d02ece4169272f73 affected < 541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f
70c464256310e1c3716099b9d02ece4169272f73 affected < 385b2d0468a0871fc716c549fa3b0c257c7dbcb3
70c464256310e1c3716099b9d02ece4169272f73 affected < c27224daf0b08efbb2b24ed64b6139b294f5473a
70c464256310e1c3716099b9d02ece4169272f73 affected < 5c7209a341ff2ac338b2b0375c34a307b37c9ac2
Linux Linux affected
Version Status Constraints
3.17 affected —
0 unaffected < 3.17
5.10.258 unaffected ≤ 5.10.*
5.15.209 unaffected ≤ 5.15.*
6.1.175 unaffected ≤ 6.1.*
6.6.141 unaffected ≤ 6.6.*
6.12.91 unaffected ≤ 6.12.*
6.18.33 unaffected ≤ 6.18.*
7.0.10 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3 cve-icon
https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f cve-icon
https://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2 cve-icon
https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4 cve-icon
https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065 cve-icon
https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e cve-icon
https://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473a cve-icon
https://git.kernel.org/stable/c/c7777f534a8018ae4bb1c80d8925af4df588a314 cve-icon
History

Wed, 24 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF. Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred listening socket code paths, hci_connect_cfm(conn) is called with hdev->lock held. Fix by holding the lock.
Title Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-24T16:30:13.570Z

Reserved: 2026-06-09T07:44:35.383Z

Link: CVE-2026-53072

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T19:30:08Z

Weaknesses

No weakness.