CVE-2026-43018: Linux Kernel Bluetooth UAF Vulnerability

CVE-2026-43018 Overview

CVE-2026-43018 is a use-after-free vulnerability in the Linux kernel Bluetooth subsystem. The flaw resides in the hci_le_remote_conn_param_req_evt handler within hci_event.c. The handler performs hci_conn lookups and field accesses outside the hdev lock critical section. A concurrent code path can free the connection object while it is still referenced, producing a classic use-after-free condition.

The upstream fix extends the hci_dev_lock critical section to cover all conn usage in the event handler. Exploitation requires adjacent network access through the Bluetooth Low Energy (BLE) stack.

Critical Impact
A remote attacker within Bluetooth range can trigger memory corruption in the kernel, potentially leading to privilege escalation, denial of service, or arbitrary kernel code execution.

Affected Products

Linux kernel versions containing the unfixed hci_le_remote_conn_param_req_evt handler in the Bluetooth HCI event path
Linux distributions shipping affected stable kernel branches prior to the patch commits
Embedded and IoT devices using vulnerable Linux kernel builds with BLE enabled

Discovery Timeline

2026-05-01 - CVE-2026-43018 published to NVD
2026-05-03 - Last updated in NVD database

Technical Details for CVE-2026-43018

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the Linux kernel Bluetooth Host Controller Interface (HCI) event subsystem. The hci_le_remote_conn_param_req_evt function handles LE Remote Connection Parameter Request events. These events are received from a connected Bluetooth Low Energy peer when the peer requests updated connection parameters.

During event processing, the handler calls hci_conn_hash_lookup_handle to retrieve the hci_conn structure associated with the connection handle. It then reads and modifies fields on that structure. The original code performed these operations without holding hci_dev_lock for the entire duration of the lookup and field access.

A concurrent kernel thread, such as a disconnect or cleanup path, can acquire hci_dev_lock, free the hci_conn object, and remove it from the connection hash. The event handler then dereferences the freed pointer, reading or writing memory that has been released or reallocated. The result is kernel memory corruption.

Root Cause

The root cause is insufficient locking scope. The hdev lock was not held across the full lifetime of the hci_conn reference inside the event handler. The fix extends the hci_dev_lock critical section so that the lookup, all field accesses, and any subsequent operations on the connection object occur atomically with respect to other connection-modifying paths.

Attack Vector

Exploitation requires the attacker to be within Bluetooth radio range of the target and to either initiate or be paired with an active BLE connection. The attacker triggers the race by sending an LE Remote Connection Parameter Request while concurrently driving disconnect or teardown logic on the same handle. Successful races corrupt kernel heap memory and can be shaped into arbitrary read or write primitives leading to local privilege escalation or kernel-level code execution.

No exploit code is publicly available. See the upstream fix commits for technical details: kernel.org commit 1d0bdbfe, commit 59eecf0f, commit 5fb69e1e, commit 7cadb03b, commit b255531b, and commit ea3cd36d.

Detection Methods for CVE-2026-43018

Indicators of Compromise

Kernel oops or panic messages referencing hci_le_remote_conn_param_req_evt, hci_conn, or the Bluetooth HCI event path
KASAN reports indicating use-after-free reads or writes inside net/bluetooth/hci_event.c
Unexpected Bluetooth subsystem crashes or bluetoothd restarts on systems with active BLE peers
Slab corruption warnings correlated with BLE connection parameter update events

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface use-after-free conditions in the HCI event path
Monitor kernel ring buffer and journalctl -k output for stack traces involving Bluetooth HCI functions
Inventory running kernel versions across Linux endpoints and compare against the patched stable branches referenced by the upstream commits
Correlate Bluetooth connection events with kernel fault telemetry to identify race-driven crashes

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized logging platform and alert on Bluetooth subsystem stack traces
Track kernel package versions through configuration management to confirm patch deployment
Monitor unexpected BUG: or WARNING: entries originating from net/bluetooth/
On endpoints that do not require Bluetooth, alert when the bluetooth kernel module is loaded

How to Mitigate CVE-2026-43018

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the kernel.org commit list as soon as vendor packages are available
Disable Bluetooth on systems that do not require it by unloading the bluetooth and btusb modules and blacklisting them in /etc/modprobe.d/
Restrict physical and radio proximity to high-value Linux systems until patched kernels are deployed
Audit IoT and embedded devices for vulnerable kernel builds and prioritize firmware updates

Patch Information

The fix extends the hci_dev_lock critical section in hci_le_remote_conn_param_req_evt to cover all hci_conn lookups and field accesses. Patches are available in stable kernel commits 1d0bdbfe, 59eecf0f, 5fb69e1e, 7cadb03b, b255531b, and ea3cd36d. Pull updated kernel packages from your distribution maintainer and reboot affected hosts.

Workarounds

Disable the Bluetooth stack entirely on servers and workstations that do not need BLE connectivity
Block loading of the bluetooth module via modprobe blacklist configuration
Restrict pairing to known devices and disable BLE peripheral mode where feasible
Place sensitive systems in RF-shielded environments to remove adjacent-network attack surface

bash

# Disable and blacklist Bluetooth kernel modules
sudo systemctl disable --now bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo rmmod btusb bluetooth 2>/dev/null

# Verify kernel version after patching
uname -r