The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-     After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management     of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only     flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before     setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu`     struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct.
    Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling     hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition     where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently     invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before     hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3.
    In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY     leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the     read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these     synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY     first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent     protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation     permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes     hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because     hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears     down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close     and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in     hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device     unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the     workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of     disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.
    (CVE-2026-46275)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-46275

high Nessus Plugin ID 319698

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.7 Jun 23, 2026, 12:13 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606230013
Version 1.6 Jun 21, 2026, 6:24 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606211824
Version 1.5 Jun 20, 2026, 5:45 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606201745
Version 1.4 Jun 15, 2026, 7:29 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606151929
Version 1.3 Jun 15, 2026, 12:58 PM CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin Feed: 202606151258
Version 1.2 Jun 10, 2026, 6:51 AM CVSS metrics ("CVSSv2 score" set to 6.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 4.7) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") CVSSv2 score source (set to "CVE-2026-46275") CVSSv2 severity (based on CVE-2026-46275, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606100651
Version 1.1 Jun 9, 2026, 4:51 AM New Plugin Feed: 202606090451