CVE-2026-43119 Bluetooth: hci_sync: annotate data-races around hdev->req_status
A data race in the Linux kernel Bluetooth subsystem could lead to undefined behavior due to unsynchronized access to request status variables.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43119?
CVE-2026-43119 is a medium-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: annotate data-races around hdev->req_status
__hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock:
hdev->req_status = HCI_REQ_PEND;
However, several other functions read or write hdev->req_status without holding any lock:
- hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue) - hci_cmd_sync_complete() reads/writes from HCI event completion - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write - hci_abort_conn() reads in connection abort path
Since __hci_cmd_sync_sk() runs on hdev->req_workqueue while hci_send_cmd_sync() runs on hdev->workqueue, these are different workqueues that can execute concurrently on different CPUs. The plain C accesses constitute a data race.
Add READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses to hdev->req_status to prevent potential compiler optimizations that could affect correctness (e.g., load fusing in the wait_event condition or store reordering).
Which versions are affected by CVE-2026-43119?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43119?
Apply the vendor's patch.
Is CVE-2026-43119 being exploited?
There is no known exploitation of CVE-2026-43119 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-85914, BELL-CVE-2026-43119, DEBIAN-CVE-2026-43119, GHSA-pp2p-vfwh-22hm, ROOT-OS-DEBIAN-11-CVE-2026-43119, ROOT-OS-DEBIAN-12-CVE-2026-43119 and 3 more.