LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: annotate data-races around hdev->req_status __hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock: hdev->req_status = HCI_REQ_PEND; However, several other functions read or write hdev->req_status without holding any lock: - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue) - hci_cmd_sync_complete() reads/writes from HCI event completion - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write - hci_abort_conn() reads in connection abort path Since __hci_cmd_sync_sk() runs on hdev->req_workqueue while hci_send_cmd_sync() runs on hdev->workqueue, these are different workqueues that can execute concurrently on different CPUs. The plain C accesses constitute a data race. Add READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses to hdev->req_status to prevent potential compiler optimizations that could affect correctness (e.g., load fusing in the wait_event condition or store reordering).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

A concurrency flaw in the Linux Bluetooth subsystem allows multiple kernel work paths to access the same request-status value unsafely. The published record warns that compiler optimizations could affect correctness. It does not establish a concrete security impact, severity score, or practical attack scenario.

Executive priority

Track promptly through routine vulnerability management, but current evidence does not justify emergency incident response. Accelerate vendor confirmation and patching for Bluetooth-intensive, safety-sensitive, or high-availability systems. Reassess priority if a severity score, concrete impact, or exploitation evidence emerges.

Technical view

Linux Bluetooth HCI synchronization code accesses hdev->req_status concurrently across separate workqueues and event, cancellation, and connection-abort paths. Some accesses occur without locking, creating a plain-C data race. The upstream resolution applies READ_ONCE() and WRITE_ONCE() annotations to constrain load fusing, store reordering, and related compiler behavior.

Likely exposure

Exposure is limited to Linux kernels containing the affected Bluetooth HCI code. The record marks entries including 5.2, 6.6.145, 6.12.83, 6.18.24, 6.19.14, and 7.0 as affected, but does not clearly define complete version ranges or distribution backport status. Systems not using Bluetooth may have lower practical exposure, although this is not confirmed as a mitigation.

Exploitation context

The supplied record does not describe exploitation, attacker prerequisites, reachable inputs, or demonstrated impact. It is not listed as KEV, and no cited source establishes active exploitation. Treat claims of remote execution, privilege escalation, or denial of service as unsupported unless later vendor analysis provides evidence.

Researcher notes

The race spans hdev->req_workqueue, hdev->workqueue, HCI event completion, cancellation, and connection-abort paths. The fix annotates concurrent accesses rather than introducing shared locking. The bundle does not provide a CVSS score, CWE, reproducer, impact demonstration, complete affected-range semantics, or mapping between each stable commit and kernel branch.

Mitigation direction

  • Check Linux distribution or device-vendor guidance for affected package versions and supported fixes.
  • Deploy a vendor kernel that incorporates the applicable cited stable fix after normal compatibility testing.
  • Prioritize Bluetooth-dependent systems once their affected status is confirmed.
  • Avoid treating Bluetooth disablement as a verified mitigation without vendor guidance.

Validation and detection

  • Inventory running kernel versions on systems with Bluetooth hardware or services enabled.
  • Compare package versions against distribution advisories and backport information.
  • Confirm the installed kernel contains the applicable stable fix or documented equivalent backport.
  • Exercise normal Bluetooth workflows after updating and monitor for regressions.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43119 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf80c5dad7b6467b884c445ffea45985793b4b2d0, f80c5dad7b6467b884c445ffea45985793b4b2d0, f80c5dad7b6467b884c445ffea45985793b4b2d0, f80c5dad7b6467b884c445ffea45985793b4b2d0, f80c5dad7b6467b884c445ffea45985793b4b2d0, 8603d49906b231bbcd9141db7d096fa1041bc379, 0e061885bfcd65ef5d09f154f3c3c3491cc7544a, a3d50fb7ce931f08a2c6194fdc4c9a56c9ed4153, 4.19.47, 5.0.20, 5.1.6unaffected
LinuxLinux5.2, 0, 6.6.145, 6.12.83, 6.18.24, 6.19.14, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.