CVE-2026-43119: Linux Kernel Race Condition Vulnerability

CVE-2026-43119 Overview

CVE-2026-43119 is a data race vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the hci_sync code path. The flaw involves unsynchronized concurrent access to the hdev->req_status field across multiple workqueues and event handlers. While __hci_cmd_sync_sk() writes hdev->req_status under hdev->req_lock, several other functions read or write the same field without holding any lock. The race manifests because __hci_cmd_sync_sk() runs on hdev->req_workqueue while hci_send_cmd_sync() runs on hdev->workqueue, allowing concurrent execution on different CPUs.

Critical Impact
Concurrent unlocked accesses to hdev->req_status constitute a plain C data race, allowing compiler optimizations such as load fusing or store reordering to corrupt Bluetooth HCI command synchronization state.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_sync.c)
Linux stable kernel branches receiving the referenced backports
Distributions shipping affected kernels with Bluetooth host controller interface support

Discovery Timeline

2026-05-06 - CVE-2026-43119 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43119

Vulnerability Analysis

The vulnerability is a kernel race condition [CWE-362] in the Bluetooth Host Controller Interface (HCI) command synchronization layer. The hdev->req_status field tracks the state of pending HCI commands and uses values such as HCI_REQ_PEND. The writer function __hci_cmd_sync_sk() correctly serializes its update under hdev->req_lock. However, multiple readers and writers operate without that lock.

The affected functions include hci_send_cmd_sync(), which reads req_status from the hci_cmd_work workqueue context, hci_cmd_sync_complete(), which reads and writes the field from HCI event completion, hci_cmd_sync_cancel() and hci_cmd_sync_cancel_sync(), which mutate the field during cancellation, and hci_abort_conn(), which reads it on the connection abort path. Because hdev->req_workqueue and hdev->workqueue are independent workqueues, their handlers can execute concurrently on different CPUs.

Root Cause

The root cause is an unannotated shared variable accessed across concurrent execution contexts. Plain C accesses to hdev->req_status permit the compiler to fuse loads inside wait_event predicates or reorder stores. These transformations can cause a waiter to miss a status transition or observe a torn value. The fix annotates all concurrent accesses with READ_ONCE() and WRITE_ONCE() to prevent harmful compiler optimizations while preserving the existing locking strategy for the primary writer.

Attack Vector

The attack vector is local and requires Bluetooth activity on the host. Triggering the race depends on timing between HCI command issuance, completion events, and cancellation paths. Successful exploitation produces incorrect synchronization state, which can lead to denial of service through stuck waiters, missed command completions, or inconsistent connection teardown behavior. The flaw is a correctness defect rather than a direct memory corruption primitive.

No verified public proof-of-concept code is available. The patch consists of READ_ONCE()/WRITE_ONCE() annotations in net/bluetooth/hci_sync.c. See the Kernel Git commit a7a1cdb4 for the upstream fix.

Detection Methods for CVE-2026-43119

Indicators of Compromise

Kernel log entries showing stalled or hung Bluetooth HCI command waiters in __hci_cmd_sync_sk().
KCSAN (Kernel Concurrency Sanitizer) reports flagging data races on hdev->req_status in net/bluetooth/hci_sync.c.
Repeated Bluetooth controller resets or HCI command timeouts logged via dmesg.

Detection Strategies

Run kernels built with CONFIG_KCSAN=y in test environments to surface the specific race on hdev->req_status.
Inventory running kernel versions across the fleet and compare against the patched stable releases referenced in the kernel.org commits.
Monitor Bluetooth subsystem health on endpoints that depend on HCI for pairing, audio, or peripheral connectivity.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on Bluetooth HCI timeout patterns.
Track package and kernel update compliance using configuration management tooling.
Audit Bluetooth usage on systems where the stack is not required and disable the module to reduce attack surface.

How to Mitigate CVE-2026-43119

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits and reboot affected hosts.
Prioritize patching on systems that actively use Bluetooth, including laptops, workstations, and embedded Linux devices.
Validate that distribution-supplied kernels include the READ_ONCE()/WRITE_ONCE() annotations on hdev->req_status.

Patch Information

The fix is delivered as a series of stable kernel commits that add READ_ONCE() and WRITE_ONCE() annotations around all concurrent accesses to hdev->req_status. Reference commits include 40734ce8, 6e539907, a7a1cdb4, and b6807cfc. Apply the kernel update provided by your Linux distribution.

Workarounds

Unload the Bluetooth kernel module with modprobe -r bluetooth on systems that do not require Bluetooth.
Blacklist the Bluetooth module in /etc/modprobe.d/ to prevent automatic loading until patched kernels are deployed.
Disable Bluetooth radios in firmware or BIOS on fixed-function appliances where the feature is unused.

bash

# Configuration example: disable Bluetooth module loading until patched
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo "blacklist btusb" | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo modprobe -r btusb bluetooth
sudo update-initramfs -u