CVE-2026-43019: Linux Kernel Bluetooth Use-After-Free

CVE-2026-43019 Overview

CVE-2026-43019 is a use-after-free (UAF) vulnerability in the Linux kernel Bluetooth subsystem. The flaw exists in the set_cig_params_sync function within hci_conn, where hci_conn lookup and field access are not protected by the hdev lock. A concurrent code path can free the hci_conn structure while set_cig_params_sync still references it, leading to memory corruption.

The vulnerability requires local access with low privileges and no user interaction. Successful exploitation can compromise confidentiality, integrity, and availability on the affected system.

Critical Impact
Concurrent access to a freed hci_conn structure can lead to kernel memory corruption and potential local privilege escalation on Linux systems with Bluetooth enabled.

Affected Products

Linux kernel versions containing the vulnerable set_cig_params_sync implementation in the Bluetooth hci_conn subsystem
Distributions shipping affected upstream kernels prior to the stable patches
Systems with Bluetooth Low Energy (LE) Isochronous Channels Group (CIG) functionality enabled

Discovery Timeline

2026-05-01 - CVE-2026-43019 published to NVD
2026-05-03 - Last updated in NVD database

Technical Details for CVE-2026-43019

Vulnerability Analysis

The vulnerability resides in the Linux kernel Bluetooth Host Controller Interface (HCI) connection handling code. Specifically, set_cig_params_sync performs lookup of an hci_conn structure and accesses its fields without holding the hdev lock. This creates a window where another kernel thread can free or modify the same hci_conn structure concurrently.

The hci_conn structure tracks active Bluetooth connections, including parameters for Connected Isochronous Group (CIG) configurations used in LE Audio. When set_cig_params_sync reads connection fields without synchronization, a competing path freeing the connection can leave dangling pointers in use. The fix introduces hdev lock acquisition to serialize access.

The maintainers note that an RCU lock alone is insufficient because the code must also avoid configuration tearing, where partial reads of inconsistent state would corrupt the CIG parameter set sent to the controller.

Root Cause

The root cause is missing locking discipline. The hci_conn lookup and subsequent field reads in set_cig_params_sync were not covered by the hdev mutex. Bluetooth subsystem concurrency primitives require holding hdev->lock when traversing or dereferencing connection list entries that other threads may delete.

Attack Vector

A local attacker with the ability to interact with the Bluetooth stack can race connection teardown against CIG parameter configuration. The attacker triggers connection setup and teardown while invoking the code path that calls set_cig_params_sync. Winning the race produces a use-after-free, which can be steered toward kernel memory corruption and privilege escalation.

The vulnerability manifests in the kernel Bluetooth subsystem. See the upstream commits referenced in the kernel.org commit 7d568fede8ea and the kernel.org commit a2639a7f0f5b for the patch details.

Detection Methods for CVE-2026-43019

Indicators of Compromise

Kernel oops or panic messages referencing set_cig_params_sync, hci_conn, or the Bluetooth subsystem in dmesg and /var/log/kern.log
KASAN reports identifying use-after-free reads in the Bluetooth HCI code path
Unexpected Bluetooth daemon (bluetoothd) crashes or repeated controller resets

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch the UAF condition during fuzzing or QA validation
Monitor system logs for kernel warnings originating in net/bluetooth/hci_conn.c and related modules
Track installed kernel package versions across the fleet and compare against patched stable releases

Monitoring Recommendations

Audit which endpoints expose Bluetooth functionality and whether unprivileged users can access HCI sockets
Forward kernel logs to a centralized logging or SIEM platform to correlate Bluetooth subsystem crashes across hosts
Alert on repeated bluetoothd restarts or HCI controller resets, which may indicate exploitation attempts

How to Mitigate CVE-2026-43019

Immediate Actions Required

Apply the upstream stable kernel patches that introduce hdev lock coverage in set_cig_params_sync
Update to a distribution kernel that incorporates the referenced commits and reboot affected hosts
Disable the Bluetooth kernel modules on systems that do not require Bluetooth functionality

Patch Information

The vulnerability is resolved by four upstream commits that take the hdev lock around hci_conn access in set_cig_params_sync. Refer to kernel.org commit 66d432e9b45b, kernel.org commit 7d568fede8ea, kernel.org commit a2639a7f0f5b, and kernel.org commit bad65b4b0a96.

Workarounds

Unload the Bluetooth kernel module with rmmod bluetooth and blacklist it on systems that do not need Bluetooth
Restrict access to HCI sockets by limiting CAP_NET_ADMIN and Bluetooth group membership to trusted users
Disable Bluetooth controllers in BIOS or UEFI firmware on servers and workstations where the radio is not required

bash

# Disable and blacklist the Bluetooth kernel module
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo 'blacklist bluetooth'    | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo 'blacklist btusb'       | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo rmmod btusb bluetooth 2>/dev/null