In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.
Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.
Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.
| Score | Percentile |
|---|---|
| 0.27% | 17.71% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 8.8 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-v6c2-56h6-9pgq ↗ |
| CVE | CVE-2026-46056 ↗ |
| CWE id | Name |
|---|---|
| CWE-416 | Use After Free |