Data Race in Bluetooth Functionality of Linux Kernel

CVE-2026-43119

What is CVE-2026-43119?

A data race vulnerability has been identified in the Bluetooth subsystem of the Linux Kernel, specifically related to the handling of the 'hdev->req_status' variable. The issue arises in the context where multiple functions access 'hdev->req_status' concurrently without proper locking mechanisms, which can lead to unpredictable behavior during Bluetooth command processing. The vulnerability allows different operations to occur on disjoint workqueues, causing inconsistent states that may affect system reliability and security. To mitigate this risk, annotations such as READ_ONCE() and WRITE_ONCE() have been implemented to ensure safer concurrent access to the shared variable, thereby enhancing the stability of Bluetooth functionalities.

References