Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-93209
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-24 16:17:15 UTC
Updated2026-09-24 16:17:15 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb BT enable fails intermittently with -ETIMEDOUT (-110). The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG), but the waiter in __hci_cmd_sync_sk() never woke up and timed out after 10 s: bluetooth hci0: Opcode 0xfc00 // __hci_cmd_sync_sk bluetooth hci0: opcode 0xfc00 plen 1 // hci_cmd_sync_add bluetooth hci0: skb len 4 // hci_cmd_sync_alloc bluetooth hci0: length 1 // hci_req_sync_run Bluetooth: hci0 cmd_cnt 1 cmd queued 1 // hci_cmd_work Bluetooth: hci0 type 1 len 4 // hci_send_frame Bluetooth: opcode 0xfc00 status 0x00 // hci_req_cmd_complete <-- req_skb NULL: req_complete_skb not set, hci_cmd_sync_complete() never called, req_status stays HCI_REQ_PEND --> <-- 10 s later: wait_event_interruptible_timeout expires --> bluetooth hci0: end: err -110 // __hci_cmd_sync_sk The root cause is that hci_send_cmd_sync() clones the sent command into hdev->req_skb so that hci_req_cmd_complete() can locate the registered completion callback. Under memory pressure this skb_clone() fails, leaving hdev->req_skb NULL. The firmware reply is received and processed, but hci_req_cmd_complete() finds NULL req_skb, so hci_cmd_sync_complete() is never called, req_status stays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT. req_skb is only used to read bt_cb(skb)->hci callbacks and opcode -- it is never modified. Replace skb_clone() with skb_get(), which simply increments the reference count of hdev->sent_cmd without allocating new memory and therefore cannot fail. This issue was first observed as a use-after-free in ttyport_close() when ttyport_open() failed, which was investigated in an earlier patch series [1]. That investigation led to the discovery of the true root cause described above. [1] https://lore.kernel.org/all/[email protected]/

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected da77c1d39bc527b31890bfa0405763c82828defb 0337fb092873a4146aa854acb554675b49c8f6b5 git Not specified
CNA Linux Linux affected 2af7aa6685e22d0dc546b0d27e5f16d3afe211fa d5eef0747071934a1c080ee617fa4fd3566394c5 git Not specified
CNA Linux Linux affected 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a d7723320db4c9cb9ec2b9a36140e6c641dd77814 git Not specified
CNA Linux Linux affected 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a d0b28e9655f4b3195210627577f81883dc1d0162 git Not specified
CNA Linux Linux affected 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a 26f66d5b8a5663af498f7ccc94fc79fb47a2191f git Not specified
CNA Linux Linux affected 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a f5afdff569a09d1cb8cf19826199d024725576cb git Not specified
CNA Linux Linux affected 4ff121be63b761950610f422437aaaef8e075c40 git Not specified
CNA Linux Linux affected 18a4c59af609994552c8b39c5438304e070e55c7 git Not specified
CNA Linux Linux affected 6.1.83 6.1.118 semver Not specified
CNA Linux Linux affected 6.6.23 6.6.157 semver Not specified
CNA Linux Linux affected 6.7.11 6.8 semver Not specified
CNA Linux Linux affected 6.8.2 6.9 semver Not specified
CNA Linux Linux affected 6.9 Not specified
CNA Linux Linux unaffected 6.9 semver Not specified
CNA Linux Linux unaffected 6.1.118 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.109 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.50 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.4 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/d5eef0747071934a1c080ee617fa4fd3566394c5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0337fb092873a4146aa854acb554675b49c8f6b5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d0b28e9655f4b3195210627577f81883dc1d0162 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/26f66d5b8a5663af498f7ccc94fc79fb47a2191f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d7723320db4c9cb9ec2b9a36140e6c641dd77814 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f5afdff569a09d1cb8cf19826199d024725576cb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report