Bug 2482181 (CVE-2026-46056) - CVE-2026-46056 kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
Summary: CVE-2026-46056 kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey...
Keywords:
Status: NEW
Alias: CVE-2026-46056
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-27 15:15 UTC by OSIDB Bzimport
Modified: 2026-09-16 00:42 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:26427 0 None None None 2026-06-16 18:55:35 UTC
Red Hat Product Errata RHSA-2026:26428 0 None None None 2026-06-16 18:29:41 UTC
Red Hat Product Errata RHSA-2026:27288 0 None None None 2026-06-19 23:22:01 UTC
Red Hat Product Errata RHSA-2026:27789 0 None None None 2026-06-22 08:29:19 UTC
Red Hat Product Errata RHSA-2026:62568 0 None None None 2026-09-02 11:02:42 UTC
Red Hat Product Errata RHSA-2026:64767 0 None None None 2026-09-08 00:23:45 UTC
Red Hat Product Errata RHSA-2026:65709 0 None None None 2026-09-09 00:46:33 UTC
Red Hat Product Errata RHSA-2026:65711 0 None None None 2026-09-09 00:40:35 UTC
Red Hat Product Errata RHSA-2026:65712 0 None None None 2026-09-09 00:57:43 UTC
Red Hat Product Errata RHSA-2026:67721 0 None None None 2026-09-16 00:14:27 UTC
Red Hat Product Errata RHSA-2026:67723 0 None None None 2026-09-16 00:42:13 UTC

Description OSIDB Bzimport 2026-05-27 15:15:08 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.

Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.

Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.
Comment 1 Keith Grant 2026-05-27 18:57:45 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46056-0ff1@gregkh/T
Comment 5 errata-xmlrpc 2026-06-16 18:29:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:26428 https://access.redhat.com/errata/RHSA-2026:26428
Comment 6 errata-xmlrpc 2026-06-16 18:55:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:26427 https://access.redhat.com/errata/RHSA-2026:26427
Comment 7 errata-xmlrpc 2026-06-19 23:22:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:27288 https://access.redhat.com/errata/RHSA-2026:27288
Comment 8 errata-xmlrpc 2026-06-22 08:29:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:27789 https://access.redhat.com/errata/RHSA-2026:27789
Comment 10 errata-xmlrpc 2026-09-02 11:02:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:62568 https://access.redhat.com/errata/RHSA-2026:62568
Comment 11 errata-xmlrpc 2026-09-08 00:23:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:64767 https://access.redhat.com/errata/RHSA-2026:64767
Comment 12 errata-xmlrpc 2026-09-09 00:40:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:65711 https://access.redhat.com/errata/RHSA-2026:65711
Comment 13 errata-xmlrpc 2026-09-09 00:46:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:65709 https://access.redhat.com/errata/RHSA-2026:65709
Comment 14 errata-xmlrpc 2026-09-09 00:57:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:65712 https://access.redhat.com/errata/RHSA-2026:65712
Comment 15 Jon Orris 2026-09-16 00:14:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:67721 https://access.redhat.com/errata/RHSA-2026:67721
Comment 16 Jon Orris 2026-09-16 00:42:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:67723 https://access.redhat.com/errata/RHSA-2026:67723
Note You need to log in before you can comment on or make changes to this bug.