CVE-2026-43018

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43018", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.975Z", "datePublished": "2026-05-01T14:15:22.308Z", "dateUpdated": "2026-10-19T19:06:09.619Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:17.496Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_le_remote_conn_param_req_evt, otherwise it's possible it is freed\nconcurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable handler processes an LE Remote Connection Parameter Request generated from Bluetooth LE link-layer traffic, so an attacker must be within Bluetooth radio range. This is adjacent-network reachability rather than IP network or local syscall access.\nAC:L - A nearby attacker can establish or use an LE connection and send connection-parameter requests, with teardown/race timing repeatable and attacker-influenced. There is no rare configuration or condition beyond normal LE controller support for this event.\nPR:N - The path is reached from Bluetooth controller events caused by a remote peer and does not require local OS privileges. The LE connection parameter request is not gated on pairing or authenticated kernel credentials.\nUI:N - In a reasonable BLE deployment where the target is connectable or accepts LE connections, the attacker can trigger the event without victim interaction. No file opening, mounting, or explicit user action is required.\nS:U - The bug is in the host kernel Bluetooth stack and impacts the same kernel security authority. It does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - This is a kernel use-after-free of an hci_conn object, with stale fields read after the object may have been freed and reused. Conservatively, kernel UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - A kernel heap UAF can be exploited through object reuse and heap shaping to corrupt data or control flow. Under the required conservative scoring, this supports high integrity impact.\nA:H - Even without full exploitation, dereferencing a freed hci_conn can cause a kernel oops or panic. Repeated adjacent Bluetooth triggering can therefore produce high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_event.c"], "versions": [{"version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "59eecf0ffde15670e6a5e10c47be67f73d843b20", "status": "affected", "versionType": "git"}, {"version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "5fb69e1eeea9d6cba80517e9f058b56b34bc3a81", "status": "affected", "versionType": "git"}, {"version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "7cadb03be37e761130edb153544fe0770a842b19", "status": "affected", "versionType": "git"}, {"version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "1d0bdbfe3e91c11f0a704c52443a9446a10d699c", "status": "affected", "versionType": "git"}, {"version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "ea3cd36d7382d5f8309df04c275d20df139ed42c", "status": "affected", "versionType": "git"}, {"version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "b255531b27da336571411248c2a72a350662bd09", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_event.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20"}, {"url": "https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81"}, {"url": "https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19"}, {"url": "https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c"}, {"url": "https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42c"}, {"url": "https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09"}], "title": "Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43018", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:13:31.348841Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:06:09.619Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43018", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:13:31.348841Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:13:31.926Z"}}], "cna": {"title": "Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable handler processes an LE Remote Connection Parameter Request generated from Bluetooth LE link-layer traffic, so an attacker must be within Bluetooth radio range. This is adjacent-network reachability rather than IP network or local syscall access.\nAC:L - A nearby attacker can establish or use an LE connection and send connection-parameter requests, with teardown/race timing repeatable and attacker-influenced. There is no rare configuration or condition beyond normal LE controller support for this event.\nPR:N - The path is reached from Bluetooth controller events caused by a remote peer and does not require local OS privileges. The LE connection parameter request is not gated on pairing or authenticated kernel credentials.\nUI:N - In a reasonable BLE deployment where the target is connectable or accepts LE connections, the attacker can trigger the event without victim interaction. No file opening, mounting, or explicit user action is required.\nS:U - The bug is in the host kernel Bluetooth stack and impacts the same kernel security authority. It does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - This is a kernel use-after-free of an hci_conn object, with stale fields read after the object may have been freed and reused. Conservatively, kernel UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - A kernel heap UAF can be exploited through object reuse and heap shaping to corrupt data or control flow. Under the required conservative scoring, this supports high integrity impact.\nA:H - Even without full exploitation, dereferencing a freed hci_conn can cause a kernel oops or panic. Repeated adjacent Bluetooth triggering can therefore produce high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "59eecf0ffde15670e6a5e10c47be67f73d843b20", "versionType": "git"}, {"status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "5fb69e1eeea9d6cba80517e9f058b56b34bc3a81", "versionType": "git"}, {"status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "7cadb03be37e761130edb153544fe0770a842b19", "versionType": "git"}, {"status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "1d0bdbfe3e91c11f0a704c52443a9446a10d699c", "versionType": "git"}, {"status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "ea3cd36d7382d5f8309df04c275d20df139ed42c", "versionType": "git"}, {"status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "lessThan": "b255531b27da336571411248c2a72a350662bd09", "versionType": "git"}], "programFiles": ["net/bluetooth/hci_event.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"status": "unaffected", "version": "0", "lessThan": "5.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.134", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.81", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/hci_event.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20"}, {"url": "https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81"}, {"url": "https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19"}, {"url": "https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c"}, {"url": "https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42c"}, {"url": "https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_le_remote_conn_param_req_evt, otherwise it's possible it is freed\nconcurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.134", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.81", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.22", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.12", "versionStartIncluding": "5.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "5.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:17.496Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43018", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:06:09.619Z", "dateReserved": "2026-05-01T14:12:55.975Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-01T14:15:22.308Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/hci_event.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "59eecf0ffde15670e6a5e10c47be67f73d843b20", "status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "versionType": "git"}, {"lessThan": "5fb69e1eeea9d6cba80517e9f058b56b34bc3a81", "status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "versionType": "git"}, {"lessThan": "7cadb03be37e761130edb153544fe0770a842b19", "status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "versionType": "git"}, {"lessThan": "1d0bdbfe3e91c11f0a704c52443a9446a10d699c", "status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "versionType": "git"}, {"lessThan": "ea3cd36d7382d5f8309df04c275d20df139ed42c", "status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "versionType": "git"}, {"lessThan": "b255531b27da336571411248c2a72a350662bd09", "status": "affected", "version": "95118dd4edfec950898a00180c6f998df0a6406d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/hci_event.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"lessThan": "5.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3AC7ECFB-6178-47EB-B821-2568DE6BFF85", "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F56F925B-BAF8-4F4B-B62F-1496AF19A307", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_le_remote_conn_param_req_evt, otherwise it's possible it is freed\nconcurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: hci_event: soluciona una posible UAF en hci_le_remote_conn_param_req_evt\n\nLa b\u00fasqueda de hci_conn y el acceso a campos deben estar cubiertos por el bloqueo hdev en hci_le_remote_conn_param_req_evt, de lo contrario, es posible que se libere concurrentemente.\n\nExtender la secci\u00f3n cr\u00edtica de hci_dev_lock para cubrir todo el uso de conn."}], "id": "CVE-2026-43018", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43018", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:13:31.348841Z", "version": "2.0.3"}}]}, "published": "2026-05-01T15:16:45.980", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt", "id": "2464464", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464464"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel's Bluetooth component. This Use-After-Free (UAF) vulnerability arises from insufficient locking during `hci_conn` lookup and access within the `hci_le_remote_conn_param_req_evt` function. An attacker could potentially exploit this to cause a system crash or execute arbitrary code."], "name": "CVE-2026-43018", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43018\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43018\nhttps://lore.kernel.org/linux-cve-announce/2026050157-CVE-2026-43018-b74a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[95118dd4edfec950898a00180c6f998df0a6406d,59eecf0ffde15670e6a5e10c47be67f73d843b20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[95118dd4edfec950898a00180c6f998df0a6406d,5fb69e1eeea9d6cba80517e9f058b56b34bc3a81)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[95118dd4edfec950898a00180c6f998df0a6406d,7cadb03be37e761130edb153544fe0770a842b19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[95118dd4edfec950898a00180c6f998df0a6406d,1d0bdbfe3e91c11f0a704c52443a9446a10d699c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[95118dd4edfec950898a00180c6f998df0a6406d,ea3cd36d7382d5f8309df04c275d20df139ed42c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[95118dd4edfec950898a00180c6f998df0a6406d,b255531b27da336571411248c2a72a350662bd09)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.168,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.134,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T18:45:15.324671+00:00", "updated": "2026-05-08T21:15:05.414113+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}