CVE-2026-93209— Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： 蓝牙：hci_core：在 req_skb 上使用 skb_get() 替代 skb_clone() 蓝牙启用功能间歇性失败，返回超时错误 （-110）。内核日志显示，HCI 读取本地版本命令已发送，且固件返回状态 0x00（由 hci_req_cmd_complete() 通过 BT_DBG 记录），但 __hci_cmd_sync_sk() 中的等待者从未被唤醒，并在 10 秒后超时： 根本原因是：hci_send_cmd_sync() 将发送的命令克隆到 hdev->
Possible ATT&CK Techniques 1 AI
T1562.008Affected Version Matrix 20
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | da77c1d39bc527b31890bfa0405763c82828defb< 0337fb092873a4146aa854acb554675b49c8f6b5 |
affected |
2af7aa6685e22d0dc546b0d27e5f16d3afe211fa< d5eef0747071934a1c080ee617fa4fd3566394c5 |
affected | ||
2615fd9a7c2507eb3be3fbe49dcec88a2f56454a< d7723320db4c9cb9ec2b9a36140e6c641dd77814 |
affected | ||
2615fd9a7c2507eb3be3fbe49dcec88a2f56454a< d0b28e9655f4b3195210627577f81883dc1d0162 |
affected | ||
2615fd9a7c2507eb3be3fbe49dcec88a2f56454a< 26f66d5b8a5663af498f7ccc94fc79fb47a2191f |
affected | ||
2615fd9a7c2507eb3be3fbe49dcec88a2f56454a< f5afdff569a09d1cb8cf19826199d024725576cb |
affected | ||
4ff121be63b761950610f422437aaaef8e075c40 |
affected | ||
18a4c59af609994552c8b39c5438304e070e55c7 |
affected | ||
| … +12 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93209
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
BT enable fails intermittently with -ETIMEDOUT (-110). The kernel log
shows the HCI Read Local Version command was sent and the firmware
replied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG),
but the waiter in __hci_cmd_sync_sk() never woke up and timed out
after 10 s:
bluetooth hci0: Opcode 0xfc00 // __hci_cmd_sync_sk
bluetooth hci0: opcode 0xfc00 plen 1 // hci_cmd_sync_add
bluetooth hci0: skb len 4 // hci_cmd_sync_alloc
bluetooth hci0: length 1 // hci_req_sync_run
Bluetooth: hci0 cmd_cnt 1 cmd queued 1 // hci_cmd_work
Bluetooth: hci0 type 1 len 4 // hci_send_frame
Bluetooth: opcode 0xfc00 status 0x00 // hci_req_cmd_complete
<-- req_skb NULL: req_complete_skb not set,
hci_cmd_sync_complete() never called,
req_status stays HCI_REQ_PEND -->
<-- 10 s later: wait_event_interruptible_timeout expires -->
bluetooth hci0: end: err -110 // __hci_cmd_sync_sk
The root cause is that hci_send_cmd_sync() clones the sent command
into hdev->req_skb so that hci_req_cmd_complete() can locate the
registered completion callback. Under memory pressure this
skb_clone() fails, leaving hdev->req_skb NULL. The firmware reply
is received and processed, but hci_req_cmd_complete() finds NULL
req_skb, so hci_cmd_sync_complete() is never called, req_status
stays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT.
req_skb is only used to read bt_cb(skb)->hci callbacks and opcode --
it is never modified. Replace skb_clone() with skb_get(), which
simply increments the reference count of hdev->sent_cmd without
allocating new memory and therefore cannot fail.
This issue was first observed as a use-after-free in ttyport_close()
when ttyport_open() failed, which was investigated in an earlier
patch series [1]. That investigation led to the discovery of the
true root cause described above.
[1] https://lore.kernel.org/all/20250430111617.1151390-1-quic_cxin@quicinc.com/
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93209
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93209
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-93209 (6)
Same Patch Batch · Linux · 2026-09-24 · 234 CVEs total
| CVE-2026-93207 | 9.8 CRITICAL | SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry |
| CVE-2026-97413 | 9.8 CRITICAL | RDMA/rtrs-srv: Fix integer underflow in process_read and process_write |
| CVE-2026-93228 | 9.1 CRITICAL | svcrdma: Reject Write/Reply chunks with segcount 0 |
| CVE-2026-93793 | 8.8 HIGH | wifi: iwlwifi: mvm: validate TX_CMD response layout |
| CVE-2026-93799 | 8.8 HIGH | wifi: iwlwifi: mvm: validate sta_id in BA window status notif |
| CVE-2026-93790 | 8.8 HIGH | wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif |
| CVE-2026-93806 | 8.8 HIGH | wifi: cfg80211: validate assoc response length before status and IE access |
| CVE-2026-97442 | 8.8 HIGH | wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi |
| CVE-2026-97409 | 8.8 HIGH | nvme-fc: Do not cancel requests in io target before it is initialized |
| CVE-2026-97509 | 8.8 HIGH | thunderbolt: Keep XDomain reference during the lifetime of a service |
| CVE-2026-93280 | 8.8 HIGH | greybus: audio: bound the topology section sizes against the fetched size |
| CVE-2026-93284 | 8.8 HIGH | drm/pagemap: dma-unmap pages before handling migration errors |
| CVE-2026-97451 | 8.4 HIGH | ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) |
| CVE-2026-97452 | 8.4 HIGH | ACPICA: Prevent adding invalid references |
| CVE-2026-97455 | 8.4 HIGH | ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() |
| CVE-2026-97450 | 8.4 HIGH | ACPICA: validate handler object type in two places |
| CVE-2026-93827 | 8.4 HIGH | virtio-fs: avoid double-free on failed queue setup |
| CVE-2026-97433 | 8.2 HIGH | nvme: validate FDP configuration descriptor sizes |
| CVE-2026-93787 | 8.1 HIGH | smb: client: bound dirent name against end of SMB response in cifs_filldir |
| CVE-2026-93224 | 8.1 HIGH | svcrdma: Fix unmatched rn_unregister on failed accept |
Showing top 20 of 234 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2026-93209
No comments yet