CVE-2026-43022

Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists

MEDIUM

5.5

CVSS Score

Published: May 1, 2026 at 02:15 PM UTC

Updated: October 21, 2026 at 01:18 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources. Change the function to return -EEXIST if queue item already exists. Modify all callsites to handle that.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

6.9 ≤ v < 6.19.121499f79995c7ee58e3bfeeff75f6d1b37dcda881357603f4d396d85fbf0045512efaf1d7f7394ed7505ea2b295929e7be2b4e1bc86ee31cb7862fb016.1.120 6.6.51 6.8.9 6.9 7.0 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6f00f36db76eb8fd10d13e80e2590f23b5beaa54d

Vendor states this is fixed in 0ad2ce230b38cd4b3f6732cc609e270461e626e5 (fixed)

Vendor states this is fixed in 2969554bcfccb5c609f6b6cd4a014933f3a66dd0 (fixed)

Vendor states this is fixed in 6.12.114 (unaffected)

Vendor states this is fixed in 6.18.57 (unaffected)

Vendor states this is fixed in 6.19.12 (unaffected)

Affected range stops below 6.2, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.6.160 (unaffected)

Affected range stops below 6.7, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.9 (unaffected)

Vendor states this is fixed in 7.0 (unaffected)