CVE-2026-43119

Vulnerability

Description

CVE-2026-43119 addresses a data race in the Linux kernel's Bluetooth HCI command synchronization code. The field hdev->req_status is set under the protection of hdev->req_lock in the function __hci_cmd_sync_sk(). However, several other functions access hdev->req_status without holding any lock — including hci_send_cmd_sync() (in the hci_cmd_work workqueue), hci_cmd_sync_complete() (from HCI event completion), hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync(), and hci_abort_conn(). Because __hci_cmd_sync_sk() runs on hdev->req_workqueue and hci_send_cmd_sync() runs on a different workqueue (hdev->workqueue), these contexts can execute concurrently on different CPUs, making the plain C accesses a data race [1][2].

Attack

Vector and Prerequisites

The vulnerability is triggered locally through concurrent Bluetooth HCI command operations. No special privileges beyond the ability to issue Bluetooth commands via the kernel interface are required. An attacker with local access could exploit the race condition by crafting sequences of HCI commands that cause the data race while the workqueues execute in parallel [3].

Impact

A successful exploit of this data race could lead to incorrect synchronization behavior, such as load fusing in wait_event conditions or store reordering. This might cause command completion signals to be missed or delayed, potentially leading to a denial of service (system hang or crash) or subtle misbehavior in Bluetooth operations. The CVSS v3 score of 5.5 (medium) reflects the local access requirement and limited but impactful consequences [4].

Mitigation

The fix adds READ_ONCE()/WRITE_ONCE() annotations to all concurrent accesses of hdev->req_status, preventing compiler optimizations that could corrupt the synchronization protocol. The patch has been applied to the stable Linux kernel branches and is available in commits referenced by the CVE [1][2]. Users should update their kernels to include these patches to eliminate the race condition.