Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0011 1.7 —
AFFECTED Product Versions Fixed Linux f80c5dad7b6467b884c445ffea45985793b4b2d0 – — Linux 5.2 – 6.6.145
TIMELINE May 1 Reserved by Linux May 6 Published (CNA: Linux) Jul 24 ENRICHED — CVE-2026-43119 (Linux). Received CVSS 5.5 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: annotate data-races around hdev->req_status __hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock: hdev->req_status = HCI_REQ_PEND; However, several other functions read or write hdev->req_status without holding any lock: - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue) - hci_cmd_sync_complete() reads/writes from HCI event completion - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write - hci_abort_conn() reads in connection abort path Since __hci_cmd_sync_sk() runs on hdev->req_workqueue while hci_send_cmd_sync() runs on hdev->workqueue, these are different workqueues that can execute concurrently on different CPUs. The plain C accesses constitute a data race. Add READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses to hdev->req_status to prevent potential compiler optimizations that could affect correctness (e.g., load fusing in the wait_event condition or store reordering).
| Date | Event | Detail |
|---|---|---|
| May 1, 2026 | Reserved | Reserved by Linux |
| May 6, 2026 | Published | Published (CNA: Linux) |
| July 24, 2026 | ENRICHED | ENRICHED — CVE-2026-43119 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Authoritative record: CVE-2026-43119 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43119 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.