CVE-2026-46056 Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

🗓️ 27 May 2026 12:57:15Reported by LinuxType

Fix potential use after free in Secure Simple Pairing passkey handlers by extending host device lock to cover all connection usage.

Reporter	Title	Published	Views	Family All 129
ATTACKERKB	CVE-2026-46056	27 May 202612:57	–	attackerkb
Tenable Nessus	AlmaLinux 8 : kernel (ALSA-2026:26427)	18 Jun 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : kernel-rt (ALSA-2026:26428)	18 Jun 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : kernel (ALSA-2026:27288)	26 Jun 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : kernel (ALSA-2026:27789)	24 Jun 202600:00	–	nessus
Tenable Nessus	Debian dla-4664 : ata-modules-5.10.0-43-armmp-di - security update	3 Jul 202600:00	–	nessus
Tenable Nessus	Debian dla-4665 : affs-modules-6.1.0-48-4kc-malta-di - security update	3 Jul 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : kernel (ELSA-2026-18587)	1 Jul 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : kernel (ELSA-2026-19568)	1 Jul 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : kernel (ELSA-2026-21556)	1 Jul 202600:00	–	nessus

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/bluetooth/hci_event.c"
    ],
    "versions": [
      {
        "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
        "lessThan": "ea18732d2614557e59f4c0d8cdbe6611aeab33b7",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
        "lessThan": "d28311539ac9f65e29308ea219ecaa48aa5e76e5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
        "lessThan": "b6ae482f88654db407c8c17619d4b62959b903ef",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
        "lessThan": "204028af77a265e31ceb4ba7f643349a3cca72b2",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
        "lessThan": "01a6431766c35dfedb86e0cb5d3fc80c6d604a47",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
        "lessThan": "e08d75753db17aa943d7622f09d9c217b5bfd3b8",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
        "lessThan": "8c6443bb9257b780986fb67ec08565bf48ecb8d7",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "92a25256f142d55e25f9959441cea6ddeabae57e",
        "lessThan": "85fa3512048793076eef658f66489112dcc91993",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/bluetooth/hci_event.c"
    ],
    "versions": [
      {
        "version": "3.7",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "3.7",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.259",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.210",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.175",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.140",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.86",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.27",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.4",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7
git	www.git.kernel.org/stable/c/b6ae482f88654db407c8c17619d4b62959b903ef
git	www.git.kernel.org/stable/c/d28311539ac9f65e29308ea219ecaa48aa5e76e5
git	www.git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47
git	www.git.kernel.org/stable/c/ea18732d2614557e59f4c0d8cdbe6611aeab33b7
git	www.git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2
git	www.git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8
git	www.git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993

19 Jun 2026 11:59Current

CVSS 3.18.8

EPSS0.00262