High 7.8Published Apr 22, 2026

CVE-2026-31500Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock

Updated under an hour ago (2026-10-19 08:23 UTC)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock. When both paths manipulate hdev->req_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb(). Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer. Below is the data race report and the kasan report: BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030 write/free by task ioctl/22580: btintel_shutdown_combined+0xd0/0x360 drivers/bluetooth/btintel.c:3648 hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246 hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526 BUG: KASAN: slab-use-after-free in sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202 Read of size 4 at addr ffff888144a738dc by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	973bb97e5aee56edddaae3d5c96877101ad509c0 builds before 7e041d0aad1d4d43d921ace052e04f4e2cacaed3; 973bb97e5aee56edddaae3d5c96877101ad509c0 builds before 5f84e845648dfa86e42de5487f1a774b42f0444d; from 973bb97e5aee56edddaae3d5c96877101ad509c0 before e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5; from 973bb97e5aee56edddaae3d5c96877101ad509c0 before 66696648af477dc87859e5e4b607112f5f29d010; from 973bb97e5aee56edddaae3d5c96877101ad509c0 before f7d84737663ad4a120d2d8ef1561a4df91282c2e; 973bb97e5aee56edddaae3d5c96877101ad509c0 builds before 94d8e6fe5d0818e9300e514e095a200bd5ff93ae	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.3.1 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 4.3; 7.0; 7.0; 7.0; and 4 more ranges	NVD

References

https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3
https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444dpatch
https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5patch
https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010patch
https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2epatch
https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93aepatch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.