In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in create_big_sync() to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in create_big_complete() and re-validate the connection under hci_dev_lock() before dereferencing, matching the pattern used by create_le_conn_complete() and create_pa_complete(). Keep the hci_conn object alive across the async boundary by taking a reference via hci_conn_get() when queueing create_big_sync(), and dropping it in the completion callback. The refcount and the lock are complementary: the refcount keeps the object allocated, while hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on hdev->conn_hash, as required by hci_conn_del(). hci_conn_put() is called outside hci_dev_unlock() so the final put (which resolves to kfree() via bt_link_release) does not run under hdev->lock, though the release path would be safe either way. Without this, create_big_complete() would unconditionally dereference the conn pointer on error, causing a use-after-free via hci_connect_cfm() and hci_conn_del().

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: hci_conn: fix potential UAF in create_big_sync Add hci_conn_valid() check in create_big_sync()     to detect stale connections before proceeding with BIG creation. Handle the resulting -ECANCELED in     create_big_complete() and re-validate the connection under hci_dev_lock() before dereferencing, matching     the pattern used by create_le_conn_complete() and create_pa_complete(). Keep the hci_conn object alive     across the async boundary by taking a reference via hci_conn_get() when queueing create_big_sync(), and     dropping it in the completion callback. The refcount and the lock are complementary: the refcount keeps     the object allocated, while hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on     hdev->conn_hash, as required by hci_conn_del(). hci_conn_put() is called outside hci_dev_unlock() so the     final put (which resolves to kfree() via bt_link_release) does not run under hdev->lock, though the     release path would be safe either way. Without this, create_big_complete() would unconditionally     dereference the conn pointer on error, causing a use-after-free via hci_connect_cfm() and hci_conn_del().
    (CVE-2026-46111)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340680	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
329305	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21388-1)	Nessus	SuSE Local Security Checks	Local	high
323086	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2482-1)	Nessus	SuSE Local Security Checks	Local	high
317553	Linux Distros Unpatched Vulnerability : CVE-2026-46111	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-46111

high

Tenable Plugins

high

high

high

high

high

high