Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-53072

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF. Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred listening socket co
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:c22b76f982dfe7e28d365e0129027611bad4302fc2fbc363f5cc6310c50034bf
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"les…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4","status":"affected","version":"70c464256310e1c3716099b9d02ece4169272f73","versionType":"git"},{"lessThan":"9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e","status":"affected","version":"70c464256310e1c3716099b9d02ece4169272f73","versionType":"git"},{"lessThan":"c7777f534a8018ae4bb1c80d8925af4df588a314","status":"affected","version":"70c464256310e1c37160…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"les…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4","status":"affected","version":"70c464256310e1c3716099b9d02ece4169272f73","versionType":"git"},{"lessThan":"9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e","status":"affected","version":"70c464256310e1c3716099b9d02ece4169272f73","versionType":"git"},{"lessThan":"c7777f534a8018ae4bb1c80d8925af4df588a314","status":"affected","version":"70c464256310e1c37160…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473a"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/c7777f534a8018ae4bb1c80d8925af4df588a314"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2abb55757a743909d5fbfba353762bb4d67a39de44e0034701cdfcd199ac751e · sha256:2a8fd39289ffeb64… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer