# CVE-2026-46111: Bluetooth: hci_conn: fix potential UAF in create_big_sync CVE-2026-46111 is fixed in 16 products on 1 platform, first by SUSE-SU-2026:2482-1, released June 22, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-46111 - Priority: High - CVSS: 7.8 (Moderate) - EPSS: 0.0016 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: May 28, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-46111 ## Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in create_big_sync() to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in create_big_complete() and re-validate the connection under hci_dev_lock() before dereferencing, matching the pattern used by create_le_conn_complete() and create_pa_complete(). Keep the hci_conn object alive across the async boundary by taking a reference via hci_conn_get() when queueing create_big_sync(), and dropping it in the completion callback. The refcount and the lock are complementary: the refcount keeps the object allocated, while hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on hdev->conn_hash, as required by hci_conn_del(). hci_conn_put() is called outside hci_dev_unlock() so the final put (which resolves to kfree() via bt_link_release) does not run under hdev->lock, though the release path would be safe either way. Without this, create_big_complete() would unconditionally dereference the conn pointer on error, causing a use-after-free via hci_connect_cfm() and hci_conn_del(). ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | dtb-aarch64 opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-64kb opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-64kb sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-azure opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-azure sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-default opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-default sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-default-base opensuse-leap 16.0 | 6.12.0-160000.36.1.160000.2.17 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.60.1.150700.17.35.4 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-default-base sles 16.0 | 6.12.0-160000.36.1.160000.2.17 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-docs opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-docs sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-kvmsmall opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-kvmsmall sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-livepatch-SLE15-SP7-RT_Update_16 sles 15.7 | 1-150700.1.5.2 | [SUSE-SU-2026:2591-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2591-1.md) | Jun 23, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_16 sles 15.7 | 1-150700.15.3.2 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-obs-build opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.60.2 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-obs-qa opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-obs-qa sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-rt opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-source opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-source sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-syms opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-syms sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | kernel-zfcpdump opensuse-leap 16.0 | 6.12.0-160000.36.1 | [OPENSUSE-SU-2026:21388-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21388-1.md) | Jul 21, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.60.1 | [SUSE-SU-2026:2482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2482-1.md) | Jun 22, 2026 | | Linux | kernel-zfcpdump sles 16.0 | 6.12.0-160000.36.1 | [SUSE-SU-2026:22835-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22835-1.md) | Jul 21, 2026 | | Linux | linux Debian 12.15 (bookworm) | 6.1.187-1 | [DEBIAN-CVE-2026-46111](https://patchblox.com/security/data/fix/linux/debian-cve-2026-46111.md) | Jun 24, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.90-1 | [DEBIAN-CVE-2026-46111](https://patchblox.com/security/data/fix/linux/debian-cve-2026-46111.md) | Jun 24, 2026 | | Linux | linux Debian 14 | 7.0.7-1 | [DEBIAN-CVE-2026-46111](https://patchblox.com/security/data/fix/linux/debian-cve-2026-46111.md) | Jun 24, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.