CVE-2026-43322
HighSummary
A vulnerability related to use-after-free (UAF) in the le_read_features_complete function has been fixed in the Linux kernel, which could lead to memory management errors.
Risk Assessment
Exploitation of this vulnerability may lead to system instability and potential data leakage, posing a serious security threat to the organization.
Recommendation
It is recommended to update the Linux kernel to the latest version to eliminate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in Jądro Linux
See all- CVE-2016-8666High
The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking.
- CVE-2016-7039High
The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers.
- CVE-2015-1465High
The IPv4 implementation in the Linux kernel before version 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, allowing remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.
- CVE-2016-10229Critical
In the Linux kernel before version 4.5, there is a vulnerability that allows remote attackers to execute arbitrary code via UDP traffic. This issue occurs during an unsafe second checksum calculation during the execution of a recv system call with the MSG_PEEK flag.
- CVE-2000-0274Low
The Linux trustees kernel patch allows attackers to cause a denial of service by accessing a file or directory with a long name.
- CVE-2000-0227Low
The Linux 2.2.x kernel does not restrict the number of Unix domain sockets as defined by the wmem_max parameter, allowing local users to cause a denial of service by requesting a large number of sockets.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in le_read_features_complete This fixes the following backtrace caused by hci_conn being freed before le_read_features_complete but after hci_le_read_remote_features_sync so hci_conn_del -> hci_cmd_sync_dequeue is not able to prevent it: ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_dec_and_test include/linux/atomic/atomic-instrumented.h:1383 [inline] BUG: KASAN: slab-use-after-free in hci_conn_drop include/net/bluetooth/hci_core.h:1688 [inline] BUG: KASAN: slab-use-after-free in le_read_features_complete+0x5b/0x340 net/bluetooth/hci_sync.c:7344 Write of size 4 at addr ffff8880796b0010 by task kworker/u9:0/52 CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compu