vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-80692

Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks

HIGH
8.8
CVSS Score
Published: August 28, 2026 at 06:52 AM UTC
Updated: October 21, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
5dd0bd277a0a936708a33ecc447dce77a08cbde66.6.516.8.96.9881559af5f5c545f6828e7c74d79813eb886d523d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c
Vendor states this is fixed in 2f5d635ad5906b0235bc0c870e8beba3116e1e98 (fixed)
Vendor states this is fixed in 9a77f296aff4b2ca5f2928ab3a3220c82d8b4074 (fixed)
Vendor states this is fixed in 6.12.114 (unaffected)
Vendor states this is fixed in 6.18.57 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Affected range stops below 6.7, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 6.9 (unaffected)
Vendor states this is fixed in 7.1.8 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (5)

Source: cverecord
https://git.kernel.org/stable/c/9a77f296aff4b2ca5f2928ab3a3220c82d8b4074
Source: cverecord
https://git.kernel.org/stable/c/2f5d635ad5906b0235bc0c870e8beba3116e1e98
Source: cverecord
https://git.kernel.org/stable/c/a4de6fc95b2f36967fc247ae51cad2171194f7cd
Source: cverecord
https://git.kernel.org/stable/c/f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805
Source: cverecord
https://git.kernel.org/stable/c/301a4e2e89313dee10f0e8cb084daedbbe4a3dce

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card