CVE-2026-93209

Debolezza

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb BT enable fails intermittently with -ETIMEDOUT (-110). The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG), but the waiter in __hci_cmd_sync_sk() never woke up and timed out after 10 s: bluetooth hci0: Opcode 0xfc00 // __hci_cmd_sync_sk bluetooth hci0: opcode 0xfc00 plen 1 // hci_cmd_sync_add bluetooth hci0: skb len 4 // hci_cmd_sync_alloc bluetooth hci0: length 1 // hci_req_sync_run Bluetooth: hci0 cmd_cnt 1 cmd queued 1 // hci_cmd_work Bluetooth: hci0 type 1 len 4 // hci_send_frame Bluetooth: opcode 0xfc00 status 0x00 // hci_req_cmd_complete <-- req_skb NULL: req_complete_skb not set, hci_cmd_sync_complete() never called, req_status stays HCI_REQ_PEND --> <-- 10 s later: wait_event_interruptible_timeout expires --> bluetooth hci0: end: err -110 // __hci_cmd_sync_sk The root cause is that hci_send_cmd_sync() clones the sent command into hdev->req_skb so that hci_req_cmd_complete() can locate the registered completion callback. Under memory pressure t

Riferimenti

• https://git.kernel.org/stable/c/0337fb092873a4146aa854acb554675b49c8f6b5
• https://git.kernel.org/stable/c/26f66d5b8a5663af498f7ccc94fc79fb47a2191f
• https://git.kernel.org/stable/c/d0b28e9655f4b3195210627577f81883dc1d0162
• https://git.kernel.org/stable/c/d5eef0747071934a1c080ee617fa4fd3566394c5
• https://git.kernel.org/stable/c/d7723320db4c9cb9ec2b9a36140e6c641dd77814
• https://git.kernel.org/stable/c/f5afdff569a09d1cb8cf19826199d024725576cb