Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
CVE-2026-80692 · published 28 Aug 2026
How serious is it
- Severity: high, CVSS score 8.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-80692?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: d948e1ffa1d40240d5c81af6dcbcb87b39cb8d3c to < f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805, 881559af5f5c545f6828e7c74d79813eb886d523 to < 301a4e2e89313dee10f0e8cb084daedbbe4a3dce, 881559af5f5c545f6828e7c74d79813eb886d523 to < a4de6fc95b2f36967fc247ae51cad2171194f7cd, 881559af5f5c545f6828e7c74d79813eb886d523 to < 9a77f296aff4b2ca5f2928ab3a3220c82d8b4074
- Linux Linux: 6.9
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
There is theoretical UAF if the conn is freed while the hci_sync task
is running.
Hold refcount to avoid that.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/f0a544ef6e38e4063d0ed72ad83d6bf0f4e70805
- git.kernel.org/stable/c/301a4e2e89313dee10f0e8cb084daedbbe4a3dce
- git.kernel.org/stable/c/a4de6fc95b2f36967fc247ae51cad2171194f7cd
- git.kernel.org/stable/c/9a77f296aff4b2ca5f2928ab3a3220c82d8b4074
- git.kernel.org/stable/c/2f5d635ad5906b0235bc0c870e8beba3116e1e98
Merged from CVE List. Last updated 26 Oct 2026. All vulnerabilities · RSS · JSON