CVE-2026-46111

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_conn: fix potential UAF in create_big_sync<br /> <br /> Add hci_conn_valid() check in create_big_sync() to detect stale<br /> connections before proceeding with BIG creation. Handle the<br /> resulting -ECANCELED in create_big_complete() and re-validate the<br /> connection under hci_dev_lock() before dereferencing, matching the<br /> pattern used by create_le_conn_complete() and create_pa_complete().<br /> <br /> Keep the hci_conn object alive across the async boundary by taking<br /> a reference via hci_conn_get() when queueing create_big_sync(), and<br /> dropping it in the completion callback. The refcount and the lock<br /> are complementary: the refcount keeps the object allocated, while<br /> hci_dev_lock() serializes hci_conn_hash_del()&amp;#39;s list_del_rcu() on<br /> hdev-&gt;conn_hash, as required by hci_conn_del().<br /> <br /> hci_conn_put() is called outside hci_dev_unlock() so the final put<br /> (which resolves to kfree() via bt_link_release) does not run under<br /> hdev-&gt;lock, though the release path would be safe either way.<br /> <br /> Without this, create_big_complete() would unconditionally<br /> dereference the conn pointer on error, causing a use-after-free<br /> via hci_connect_cfm() and hci_conn_del().