CVE-2026-53072 Details
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF. Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred listening socket code paths, hci_connect_cfm(conn) is called with hdev->lock held. Fix by holding the lock.
A vulnerability in the Linux kernel's Bluetooth subsystem has been addressed, specifically related to connection request handling when the HCI_PROTO_DEFER flag is set. The issue arises in the hci_conn_request_evt() function, which calls hci_connect_cfm(conn) without holding the necessary device lock (hdev->lock). This oversight can lead to a use-after-free condition if the connection (conn) is deleted concurrently. The vulnerability affects only SCO and ISO protocols, and under normal circumstances, hci_connect_cfm() is called with the lock held. The vulnerability has been fixed by ensuring the lock is properly maintained.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f | kernel.org | Patch |
| https://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e | kernel.org | Patch |
| https://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473a | kernel.org | Patch |
| https://git.kernel.org/stable/c/c7777f534a8018ae4bb1c80d8925af4df588a314 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-667 | Improper Locking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.17, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.141 >= 6.7, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 24, 2026 | New CVE Received | kernel.org |