CVE-2026-93209
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb BT enable fails intermittently with -ETIMEDOUT (-110). The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG), but the waiter in __hci_cmd_sync_sk() never woke up and timed out after 10 s: bluetooth hci0: Opcode 0xfc00 // __hci_cmd_sync_sk bluetooth hci0: opcode 0xfc00 plen 1 // hci_cmd_sync_add bluetooth hci0: skb len 4 // hci_cmd_sync_alloc bluetooth hci0: length 1 // hci_req_sync_run Bluetooth: hci0 cmd_cnt 1 cmd queued 1 // hci_cmd_work Bluetooth: hci0 type 1 len 4 // hci_send_frame Bluetooth: opcode 0xfc00 status 0x00 // hci_req_cmd_complete <-- req_skb NULL: req_complete_skb not set, hci_cmd_sync_complete() never called, req_status stays HCI_REQ_PEND --> <-- 10 s later: wait_event_interruptible_timeout expires --> bluetooth hci0: end: err -110 // __hci_cmd_sync_sk The root cause is that hci_send_cmd_sync() clones the sent command into hdev->req_skb so that hci_req_cmd_complete() can locate the registered completion callback. Under memory pressure this skb_clone() fails, leaving hdev->req_skb NULL. The firmware reply is received and processed, but hci_req_cmd_complete() finds NULL req_skb, so hci_cmd_sync_complete() is never called, req_status stays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT. req_skb is only used to read bt_cb(skb)->hci callbacks and opcode -- it is never modified. Replace skb_clone() with skb_get(), which simply increments the reference count of hdev->sent_cmd without allocating new memory and therefore cannot fail. This issue was first observed as a use-after-free in ttyport_close() when ttyport_open() failed, which was investigated in an earlier patch series [1]. That investigation led to the discovery of the true root cause described above. [1] https://lore.kernel.org/all/[email protected]/
How to fix
- Linux Linux0337fb092873a4146aa854acb554675b49c8f6b5, d5eef0747071934a1c080ee617fa4fd3566394c5, d7723320db4c9cb9ec2b9a36140e6c641dd77814, d0b28e9655f4b3195210627577f81883dc1d0162, 26f66d5b8a5663af498f7ccc94fc79fb47a2191f, f5afdff569a09d1cb8cf19826199d024725576cb, 6.1.118, 6.6.157, 6.8, 6.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | da77c1d39bc527b31890bfa0405763c82828defb ≤ v < 0337fb092873a4146aa854acb554675b49c8f6b5, 2af7aa6685e22d0dc546b0d27e5f16d3afe211fa ≤ v < d5eef0747071934a1c080ee617fa4fd3566394c5, 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a ≤ v < d7723320db4c9cb9ec2b9a36140e6c641dd77814, 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a ≤ v < d0b28e9655f4b3195210627577f81883dc1d0162, 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a ≤ v < 26f66d5b8a5663af498f7ccc94fc79fb47a2191f, 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a ≤ v < f5afdff569a09d1cb8cf19826199d024725576cb, 4ff121be63b761950610f422437aaaef8e075c40, 18a4c59af609994552c8b39c5438304e070e55c7, 6.1.83 ≤ v < 6.1.118, 6.6.23 ≤ v < 6.6.157, 6.7.11 ≤ v < 6.8, 6.8.2 ≤ v < 6.9, 6.9 | 0337fb092873a4146aa854acb554675b49c8f6b5, d5eef0747071934a1c080ee617fa4fd3566394c5, d7723320db4c9cb9ec2b9a36140e6c641dd77814, d0b28e9655f4b3195210627577f81883dc1d0162, 26f66d5b8a5663af498f7ccc94fc79fb47a2191f, f5afdff569a09d1cb8cf19826199d024725576cb, 6.1.118, 6.6.157, 6.8, 6.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.