[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-46275":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-30T21:17:53.703Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":14,"duplicates":35,"related":36,"reserved_at":9,"published_at":40,"modified_at":41,"state":42,"summary":43,"references_raw":52,"kevs":86,"epss":87,"epss_history":90,"metrics":171,"affected":179},"CVE-2026-46275","In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n\nVulnerabilities leading to Use-After-Free (UAF) and Null Pointer\nDereference (NPD) conditions were observed in the lifecycle management\nof hci_uart.\n\nThe primary issue arises because the workqueues (init_ready and\nwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READY\nflag is set during TTY close. If a hangup occurs before setup completes,\nhci_uart_tty_close() skips the teardown of these workqueues and\nproceeds to free the `hu` struct. When the scheduled work executes\nlater, it blindly dereferences the freed `hu` struct.\n\nFurthermore, several data races and UAFs were identified in the teardown\nsequence:\n1. Calling hci_uart_flush() from hci_uart_close() without effectively\n   disabling write_work causes a race condition where both can concurrently\n   double-free hu->tx_skb. This happens because protocol timers can\n   concurrently invoke hci_uart_tx_wakeup() and requeue write_work.\n2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF\n   when vendor specific protocol close callbacks dereference hu->hdev.\n3. In the initialization error paths, failing to take the proto_lock\n   write lock before clearing PROTO_READY leads to races with active\n   readers. Additionally, hci_uart_tty_receive() accesses hu->hdev\n   outside the read lock, leading to UAFs if the initialization error\n   path frees hdev concurrently.\n\nFix these synchronization and lifecycle issues by:\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,\n   followed immediately by a cancel_work_sync(&hu->write_work). Clearing\n   the flag locks out concurrent protocol timers from successfully invoking\n   hci_uart_tx_wakeup(), effectively rendering the cancellation permanent\n   and preventing the tx_skb double-free.\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip\n   hu->proto->flush(). This is perfectly safe in the tty_close path\n   because hu->proto->close() executes shortly after, which intrinsically\n   purges all protocol SKB queues and tears down the state.\n3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev)\n   across all close and error paths to prevent vendor-level UAFs.\n4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive()\n   inside the proto_lock read-side critical section to safely synchronize\n   with device unregistration.\n5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely\n   flush the workqueue before hci_uart_flush() is invoked via the HCI core.\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across\n   all paths to prevent permanently breaking user-space retry capabilities.",null,[],[],[],[],[15,17,19,21,23,25,27,29,31,33],{"_key":16},"OPENSUSE-SU-2026:11014-1",{"_key":18},"DEBIAN-CVE-2026-46275",{"_key":20},"SUSE-SU-2026:2914-1",{"_key":22},"SUSE-SU-2026:3130-1",{"_key":24},"UBUNTU-CVE-2026-46275",{"_key":26},"USN-8566-1",{"_key":28},"USN-8568-1",{"_key":30},"USN-8569-1",{"_key":32},"USN-8575-1",{"_key":34},"USN-8576-1",[],[37,38,39],{"_key":16},{"_key":20},{"_key":22},"2026-06-08T14:30:54.232Z","2026-06-14T18:05:39.086Z","Received",{"cisa_kev":44,"cisa_ransomware":44,"cisa_vendor":9,"epss_severity":45,"epss_score":46,"severity":47,"severity_score":48,"severity_version":49,"severity_source":50,"severity_vector":51,"severity_status":42},false,"low",0.00204,"high",7.8,"v3.1","cve.org","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[53,58,62,66,70,74,78,82],{"url":54,"sources":55,"tags":57},"https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c",[50,56],"nvd",[],{"url":59,"sources":60,"tags":61},"https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339",[50,56],[],{"url":63,"sources":64,"tags":65},"https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6",[50,56],[],{"url":67,"sources":68,"tags":69},"https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34",[50,56],[],{"url":71,"sources":72,"tags":73},"https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d",[50,56],[],{"url":75,"sources":76,"tags":77},"https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",[50,56],[],{"url":79,"sources":80,"tags":81},"https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8",[50,56],[],{"url":83,"sources":84,"tags":85},"https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",[50,56],[],[],{"date":88,"score":46,"percentile":89},"2026-07-05",0.10426,[91,95,98,101,104,107,111,114,117,120,122,125,128,131,134,137,140,143,146,149,152,155,158,161,164,167,170],{"date":92,"score":93,"percentile":94},"2026-06-09",0.00024,0.07237,{"date":96,"score":93,"percentile":97},"2026-06-10",0.0726,{"date":99,"score":93,"percentile":100},"2026-06-11",0.07279,{"date":102,"score":93,"percentile":103},"2026-06-12",0.07321,{"date":105,"score":93,"percentile":106},"2026-06-13",0.07312,{"date":108,"score":109,"percentile":110},"2026-06-14",0.00013,0.02402,{"date":112,"score":46,"percentile":113},"2026-06-15",0.10333,{"date":115,"score":46,"percentile":116},"2026-06-16",0.10346,{"date":118,"score":46,"percentile":119},"2026-06-17",0.10344,{"date":121,"score":46,"percentile":119},"2026-06-18",{"date":123,"score":46,"percentile":124},"2026-06-19",0.10313,{"date":126,"score":46,"percentile":127},"2026-06-20",0.10305,{"date":129,"score":46,"percentile":130},"2026-06-21",0.10274,{"date":132,"score":46,"percentile":133},"2026-06-22",0.10267,{"date":135,"score":46,"percentile":136},"2026-06-23",0.1029,{"date":138,"score":46,"percentile":139},"2026-06-24",0.10301,{"date":141,"score":46,"percentile":142},"2026-06-25",0.10392,{"date":144,"score":46,"percentile":145},"2026-06-26",0.1042,{"date":147,"score":46,"percentile":148},"2026-06-27",0.10448,{"date":150,"score":46,"percentile":151},"2026-06-28",0.10413,{"date":153,"score":46,"percentile":154},"2026-06-29",0.10401,{"date":156,"score":46,"percentile":157},"2026-06-30",0.10407,{"date":159,"score":46,"percentile":160},"2026-07-01",0.10452,{"date":162,"score":46,"percentile":163},"2026-07-02",0.10441,{"date":165,"score":46,"percentile":166},"2026-07-03",0.10431,{"date":168,"score":46,"percentile":169},"2026-07-04",0.10427,{"date":88,"score":46,"percentile":89},[172,177],{"source":50,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":173,"cvss_v4_0":9},{"baseScore":48,"baseSeverity":174,"vectorString":51,"impactScore":175,"exploitabilityScore":176},"HIGH",9.8,4.6,{"source":56,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":178,"cvss_v4_0":9},{"baseScore":48,"baseSeverity":174,"vectorString":51,"impactScore":175,"exploitabilityScore":176},[180],{"ecosystem":9,"name":181,"vendor":182,"product":182,"cpe_part":183,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":184},"Linux","linux","a",[185,192,195,198,201,204,207,210,213,215,217,219,221,223,227,231,235,239,243],{"version":186,"is_range":187,"range_type":50,"version_start":188,"version_start_type":189,"version_end":190,"version_end_type":191,"fixed_in":9},">= 3b799254cf6f481460719023d7a18f46651e5e7f, \u003C 78aad93e938f013d9272fe0ee168f27883afa95c",true,"3b799254cf6f481460719023d7a18f46651e5e7f","including","78aad93e938f013d9272fe0ee168f27883afa95c","excluding",{"version":193,"is_range":187,"range_type":50,"version_start":188,"version_start_type":189,"version_end":194,"version_end_type":191,"fixed_in":9},">= 3b799254cf6f481460719023d7a18f46651e5e7f, \u003C e2d19969c8d9198ecc3090bcd5312ecd503a3339","e2d19969c8d9198ecc3090bcd5312ecd503a3339",{"version":196,"is_range":187,"range_type":50,"version_start":188,"version_start_type":189,"version_end":197,"version_end_type":191,"fixed_in":9},">= 3b799254cf6f481460719023d7a18f46651e5e7f, \u003C c85cff648a2bc92322912db5f1727ad05afae7b6","c85cff648a2bc92322912db5f1727ad05afae7b6",{"version":199,"is_range":187,"range_type":50,"version_start":188,"version_start_type":189,"version_end":200,"version_end_type":191,"fixed_in":9},">= 3b799254cf6f481460719023d7a18f46651e5e7f, \u003C 9d20d48be2c4a071fb015eb09bda2cecd25daf34","9d20d48be2c4a071fb015eb09bda2cecd25daf34",{"version":202,"is_range":187,"range_type":50,"version_start":188,"version_start_type":189,"version_end":203,"version_end_type":191,"fixed_in":9},">= 3b799254cf6f481460719023d7a18f46651e5e7f, \u003C 81c7a3c22a0f2808cf4ae0b4908f59763b23606d","81c7a3c22a0f2808cf4ae0b4908f59763b23606d",{"version":205,"is_range":187,"range_type":50,"version_start":188,"version_start_type":189,"version_end":206,"version_end_type":191,"fixed_in":9},">= 3b799254cf6f481460719023d7a18f46651e5e7f, \u003C 192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894","192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",{"version":208,"is_range":187,"range_type":50,"version_start":188,"version_start_type":189,"version_end":209,"version_end_type":191,"fixed_in":9},">= 3b799254cf6f481460719023d7a18f46651e5e7f, \u003C 7338031946bd06f6dff149e67b60c4cd083bfea8","7338031946bd06f6dff149e67b60c4cd083bfea8",{"version":211,"is_range":187,"range_type":50,"version_start":188,"version_start_type":189,"version_end":212,"version_end_type":191,"fixed_in":9},">= 3b799254cf6f481460719023d7a18f46651e5e7f, \u003C c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b","c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",{"version":214,"is_range":44,"range_type":50,"version_start":214,"version_start_type":189,"version_end":214,"version_end_type":189,"fixed_in":9},"cd27019bc149f20f12ebec943c2b4c775745a5a0",{"version":216,"is_range":44,"range_type":50,"version_start":216,"version_start_type":189,"version_end":216,"version_end_type":189,"fixed_in":9},"aea63181b6fcb6b9ccde1ada9ea51be19c4015af",{"version":218,"is_range":44,"range_type":50,"version_start":218,"version_start_type":189,"version_end":218,"version_end_type":189,"fixed_in":9},"0d234d1135dcd8876de0576dac68efd0a87eef87",{"version":220,"is_range":44,"range_type":50,"version_start":220,"version_start_type":189,"version_end":220,"version_end_type":189,"fixed_in":9},"3fe978892ab46efc2f3830d9abc015eff72caaf9",{"version":222,"is_range":44,"range_type":50,"version_start":222,"version_start_type":189,"version_end":222,"version_end_type":189,"fixed_in":9},"0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f",{"version":224,"is_range":187,"range_type":50,"version_start":225,"version_start_type":189,"version_end":226,"version_end_type":191,"fixed_in":9},">= 4.14.203, \u003C 4.15","4.14.203","4.15",{"version":228,"is_range":187,"range_type":50,"version_start":229,"version_start_type":189,"version_end":230,"version_end_type":191,"fixed_in":9},">= 4.19.153, \u003C 4.20","4.19.153","4.20",{"version":232,"is_range":187,"range_type":50,"version_start":233,"version_start_type":189,"version_end":234,"version_end_type":191,"fixed_in":9},">= 5.4.73, \u003C 5.5","5.4.73","5.5",{"version":236,"is_range":187,"range_type":50,"version_start":237,"version_start_type":189,"version_end":238,"version_end_type":191,"fixed_in":9},">= 5.8.17, \u003C 5.9","5.8.17","5.9",{"version":240,"is_range":187,"range_type":50,"version_start":241,"version_start_type":189,"version_end":242,"version_end_type":191,"fixed_in":9},">= 5.9.2, \u003C 5.10","5.9.2","5.10",{"version":242,"is_range":44,"range_type":50,"version_start":242,"version_start_type":189,"version_end":242,"version_end_type":189,"fixed_in":9}]