What is CVE-2026-46056?

CVE-2026-46056 is a High severity Linux kernel vulnerability with a CVSS score of 8.8 out of 10, classified as a Use After Free flaw (CWE-416), affecting Linux kernel versions from 3.7 onward and patched in 5.10.259, 5.15.210, 6.1.175 and others. CVE-2026-46056 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-46056?

CVE-2026-46056 has a CVSS score of 8.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-46056?

Yes, CVE-2026-46056 has been patched. Fixed versions include 5.10.259, 5.15.210, 6.1.175 and others. If you are running Linux kernel 3.7 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-46056 actively exploited?

CVE-2026-46056 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Use After Free (CWE-416)?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/416.html

CVE-2026-46056

High

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage in both handlers. Keep the existing keypress notification behavior unchanged by routing the early exits through a common unlock path.

Package Linux Kernel

Published 2026-05-27

Last modified 2026-06-19

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

8.8

out of 10

High

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-416

CVE-2026-46056 is a Use After Free vulnerability

What is Use After Free?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. Learn more on MITRE CWE

Affected versions

Linux kernel versions 3.7 and later are affected. Fixed in 5.10.259, 5.15.210, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1 and their respective stable series.

Affected from

≥ 3.7

Fixed in

✓ 5.10.259 5.10.x ✓ 5.15.210 5.15.x ✓ 6.1.175 6.1.x ✓ 6.6.140 6.6.x ✓ 6.12.86 6.12.x ✓ 6.18.27 6.18.x ✓ 7.0.4 7.0.x ✓ 7.1

References

8 total

Kernel Git
https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47

Patch
Kernel Git
https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2

Patch
Kernel Git
https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993

Patch
Kernel Git
https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7

Patch
Kernel Git
https://git.kernel.org/stable/c/b6ae482f88654db407c8c17619d4b62959b903ef

Patch

Showing 5 of 8 references View all on NVD

Details

CVE ID CVE-2026-46056

Severity High

CVSS score 8.8 / 10

CVSS version 3.1

Published 2026-05-27

Modified 2026-06-19

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-46056?

CVE-2026-46056 is a High severity Linux kernel vulnerability with a CVSS score of 8.8 out of 10 , classified as an Use After Free flaw (CWE-416) . It affects Linux kernel versions from 3.7 onward and has been patched in 5.10.259, 5.15.210, 6.1.175 and others. CVE-2026-46056 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-46056?

CVE-2026-46056 has a CVSS score of 8.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-46056?

Yes. CVE-2026-46056 has been patched. Fixed versions include 5.10.259, 5.15.210, 6.1.175 and others. If you are running Linux kernel 3.7 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-46056 actively exploited?

No. CVE-2026-46056 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.