In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and "UAF". Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2025120823-CVE-2025-40318-0f27@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:1194 https://access.redhat.com/errata/RHSA-2026:1194
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:1690 https://access.redhat.com/errata/RHSA-2026:1690
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:1727 https://access.redhat.com/errata/RHSA-2026:1727
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:2212 https://access.redhat.com/errata/RHSA-2026:2212