{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"7e041d0aad1d4d43d921ace052e04f4e2cacaed3","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"5f84e845648dfa86e42de5487f1a774b42f0444d","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"66696648af477dc87859e5e4b607112f5f29d010","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"f7d84737663ad4a120d2d8ef1561a4df91282c2e","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"94d8e6fe5d0818e9300e514e095a200bd5ff93ae","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.3"},{"lessThan":"4.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-31500","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock().  This lets it race against\nhci_dev_do_close() -> btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock.  When both paths manipulate\nhdev->req_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n  BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n  read of hdev->req_rsp at net/bluetooth/hci_sync.c:199\n  by task kworker/u17:1/83:\n   __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n   __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n   btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n   hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n  write/free by task ioctl/22580:\n   btintel_shutdown_combined+0xd0/0x360\n    drivers/bluetooth/btintel.c:3648\n   hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n   hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n  BUG: KASAN: slab-use-after-free in\n   sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n  Read of size 4 at addr ffff888144a738dc\n  by task kworker/u17:1/83:\n   __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n   __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n   btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260","epss":{"date":"2026-11-05","percentile":0.02266,"score":0.00126},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915103558,"publishedAt":1776866061071,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"remediation":[],"revision":"f93777fa4b6ca4d28e79ae61479dc7181dbab5b5884867cb766fc595ca5afa2d","sources":[{"modifiedAt":1793915103558,"name":"CNA: Linux","retrievedAt":1793917071462,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31500"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917073203,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31500"}],"ssvc":{"assessedAt":1793914557538,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock","updatedAt":1793917073203}