{"id":"CVE-2026-93209","summary":"Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb\n\nBT enable fails intermittently with -ETIMEDOUT (-110).  The kernel log\nshows the HCI Read Local Version command was sent and the firmware\nreplied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG),\nbut the waiter in __hci_cmd_sync_sk() never woke up and timed out\nafter 10 s:\n\n  bluetooth hci0: Opcode 0xfc00              // __hci_cmd_sync_sk\n  bluetooth hci0: opcode 0xfc00 plen 1       // hci_cmd_sync_add\n  bluetooth hci0: skb len 4                  // hci_cmd_sync_alloc\n  bluetooth hci0: length 1                   // hci_req_sync_run\n  Bluetooth: hci0 cmd_cnt 1 cmd queued 1     // hci_cmd_work\n  Bluetooth: hci0 type 1 len 4               // hci_send_frame\n  Bluetooth: opcode 0xfc00 status 0x00       // hci_req_cmd_complete\n  \u003c-- req_skb NULL: req_complete_skb not set,\n      hci_cmd_sync_complete() never called,\n      req_status stays HCI_REQ_PEND            --\u003e\n  \u003c-- 10 s later: wait_event_interruptible_timeout expires --\u003e\n  bluetooth hci0: end: err -110              // __hci_cmd_sync_sk\n\nThe root cause is that hci_send_cmd_sync() clones the sent command\ninto hdev-\u003ereq_skb so that hci_req_cmd_complete() can locate the\nregistered completion callback.  Under memory pressure this\nskb_clone() fails, leaving hdev-\u003ereq_skb NULL.  The firmware reply\nis received and processed, but hci_req_cmd_complete() finds NULL\nreq_skb, so hci_cmd_sync_complete() is never called, req_status\nstays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT.\n\nreq_skb is only used to read bt_cb(skb)-\u003ehci callbacks and opcode --\nit is never modified.  Replace skb_clone() with skb_get(), which\nsimply increments the reference count of hdev-\u003esent_cmd without\nallocating new memory and therefore cannot fail.\n\nThis issue was first observed as a use-after-free in ttyport_close()\nwhen ttyport_open() failed, which was investigated in an earlier\npatch series [1].  That investigation led to the discovery of the\ntrue root cause described above.\n\n[1] https://lore.kernel.org/all/20250430111617.1151390-1-quic_cxin@quicinc.com/","modified":"2026-11-13T04:02:49.824632237Z","published":"2026-09-24T15:10:32.762Z","related":["SUSE-SU-2026:24643-1","SUSE-SU-2026:24648-1","SUSE-SU-2026:24651-1","SUSE-SU-2026:24662-1","SUSE-SU-2026:5091-1","openSUSE-SU-2026:11893-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93209.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0337fb092873a4146aa854acb554675b49c8f6b5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/26f66d5b8a5663af498f7ccc94fc79fb47a2191f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d0b28e9655f4b3195210627577f81883dc1d0162"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d5eef0747071934a1c080ee617fa4fd3566394c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d7723320db4c9cb9ec2b9a36140e6c641dd77814"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f5afdff569a09d1cb8cf19826199d024725576cb"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93209.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93209"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"da77c1d39bc527b31890bfa0405763c82828defb"},{"fixed":"0337fb092873a4146aa854acb554675b49c8f6b5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2af7aa6685e22d0dc546b0d27e5f16d3afe211fa"},{"fixed":"d5eef0747071934a1c080ee617fa4fd3566394c5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a"},{"fixed":"d7723320db4c9cb9ec2b9a36140e6c641dd77814"},{"fixed":"d0b28e9655f4b3195210627577f81883dc1d0162"},{"fixed":"26f66d5b8a5663af498f7ccc94fc79fb47a2191f"},{"fixed":"f5afdff569a09d1cb8cf19826199d024725576cb"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4ff121be63b761950610f422437aaaef8e075c40"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"18a4c59af609994552c8b39c5438304e070e55c7"}]}],"versions":["v6.1.117","v6.1.116","v6.1.115","v6.1.114","v6.1.113","v6.1.112","v6.1.111","v6.1.110","v6.1.109","v6.1.108","v6.1.107","v6.1.106","v6.1.105","v6.1.104","v6.1.103","v6.1.102","v6.1.101","v6.1.100","v6.1.99","v6.1.98","v6.1.97","v6.1.96","v6.1.95","v6.1.94","v6.1.93","v6.1.92","v6.1.91","v6.1.90","v6.1.89","v6.1.88","v6.1.87","v6.1.86","v6.1.85","v6.1.84","v6.1.83","v6.6.156","v6.6.155","v6.6.154","v6.6.153","v6.6.152","v6.6.151","v6.6.150","v6.6.149","v6.6.148","v6.6.147","v6.6.146","v6.6.145","v6.6.144","v6.6.143","v6.6.142","v6.6.141","v6.6.140","v6.6.139","v6.6.138","v6.6.137","v6.6.136","v6.6.135","v6.6.134","v6.6.133","v6.6.132","v6.6.131","v6.6.130","v6.6.129","v6.6.128","v6.6.127","v6.6.126","v6.6.125","v6.6.124","v6.6.123","v6.6.122","v6.6.121","v6.6.120","v6.6.119","v6.6.118","v6.6.117","v6.6.116","v6.6.115","v6.6.114","v6.6.113","v6.6.112","v6.6.111","v6.6.110","v6.6.109","v6.6.108","v6.6.107","v6.6.106","v6.6.105","v6.6.104","v6.6.103","v6.6.102","v6.6.101","v6.6.100","v6.6.99","v6.6.98","v6.6.97","v6.6.96","v6.6.95","v6.6.94","v6.6.93","v6.6.92","v6.6.91","v6.6.90","v6.6.89","v6.6.88","v6.6.87","v6.6.86","v6.6.85","v6.6.84","v6.6.83","v6.6.82","v6.6.81","v6.6.80","v6.6.79","v6.6.78","v6.6.77","v6.6.76","v6.6.75","v6.6.74","v6.6.73","v6.6.72","v6.6.71","v6.6.70","v6.6.69","v6.6.68","v6.6.67","v6.6.66","v6.6.65","v6.6.64","v6.6.63","v6.6.62","v6.6.61","v6.6.60","v6.6.59","v6.6.58","v6.6.57","v6.6.56","v6.6.55","v6.6.54","v6.6.53","v6.6.52","v6.6.51","v6.6.50","v6.6.49","v6.6.48","v6.6.47","v6.6.46","v6.6.45","v6.6.44","v6.6.43","v6.6.42","v6.6.41","v6.6.40","v6.6.39","v6.6.38","v6.6.37","v6.6.36","v6.6.35","v6.6.34","v6.6.33","v6.6.32","v6.6.31","v6.6.30","v6.6.29","v6.6.28","v6.6.27","v6.6.26","v6.6.25","v6.6.24","v6.6.23","v6.7.12","v6.7.11","v6.8.12","v6.8.11","v6.8.10","v6.8.9","v6.8.8","v6.8.7","v6.8.6","v6.8.5","v6.8.4","v6.8.3","v6.8.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93209.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.83"},{"fixed":"6.1.118"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.6.23"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.11"},{"fixed":"6.8"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.8.2"},{"fixed":"6.9"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.9.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93209.json"}}],"schema_version":"1.9.2"}