CVE-2026-93209

CVE CVE-2026-93209EUVD EUVD-2026-85938Published 2026-09-24T15:10:32.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb BT enable fails intermittently with -ETIMEDOUT (-110). The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG), but the waiter in __hci_cmd_sync_sk() never woke up and timed out after 10 s: bluetooth hci0: Opcode 0xfc00 // __hci_cmd_sync_sk bluetooth hci0: opcode 0xfc00 plen 1 // hci_cmd_sync_add bluetooth hci0: skb len 4 // hci_cmd_sync_alloc bluetooth hci0: length 1 // hci_req_sync_run Bluetooth: hci0 cmd_cnt 1 cmd queued 1 // hci_cmd_work Bluetooth: hci0 type 1 len 4 // hci_send_frame Bluetooth: opcode 0xfc00 status 0x00 // hci_req_cmd_complete <-- req_skb NULL: req_complete_skb not set, hci_cmd_sync_complete() never called, req_status stays HCI_REQ_PEND --> <-- 10 s later: wait_event_interruptible_timeout expires --> bluetooth hci0: end: err -110 // __hci_cmd_sync_sk The root cause is that hci_send_cmd_sync() clones the sent command into hdev->req_skb so that hci_req_cmd_complete() can locate the registered completion callback. Under memory pressure this skb_clone() fails, leaving hdev->req_skb NULL. The firmware reply is received and processed, but hci_req_cmd_complete() finds NULL req_skb, so hci_cmd_sync_complete() is never called, req_status stays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT. req_skb is only used to read bt_cb(skb)->hci callbacks and opcode -- it is never modified. Replace skb_clone() with skb_get(), which simply increments the reference count of hdev->sent_cmd without allocating new memory and therefore cannot fail. This issue was first observed as a use-after-free in ttyport_close() when ttyport_open() failed, which was investigated in an earlier patch series [1]. That investigation led to the discovery of the true root cause described above. [1] https://lore.kernel.org/all/20250430111617.1151390-1-quic_cxin@quicinc.com/

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 4ff121be63b761950610f422437aaaef8e075c40; patch: 6.6.157; da77c1d39bc527b31890bfa0405763c82828defb <0337fb092873a4146aa854acb554675b49c8f6b5; patch: 7.3-rc1; 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a <f5afdff569a09d1cb8cf19826199d024725576cb; patch: 6.12.109; 6.9; 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a <26f66d5b8a5663af498f7ccc94fc79fb47a2191f; patch: 6.1.118; 6.8.2 <6.9; 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a <d7723320db4c9cb9ec2b9a36140e6c641dd77814; patch: 0; 18a4c59af609994552c8b39c5438304e070e55c7; patch: 7.2.4; 6.7.11 <6.8; 2af7aa6685e22d0dc546b0d27e5f16d3afe211fa <d5eef0747071934a1c080ee617fa4fd3566394c5; 6.6.23 <6.6.157; 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a <d0b28e9655f4b3195210627577f81883dc1d0162; 6.1.83 <6.1.118; patch: 6.18.50

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.