CVE-2026-68391

Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel Bluetooth Subsystem

Publication date: 2026-08-10

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68391

EUVD

EUVD-2026-55577

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of Bluetooth management commands. It occurs when hci_conn pointers in mgmt_pending_cmds are dereferenced outside critical sections, leading to a use-after-free (UAF) condition. The issue requires holding appropriate locks and reference counts to ensure pointer validity and prevent data races.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth management subsystem. Detection requires checking kernel logs for Bluetooth-related errors or crashes, particularly involving hci_conn or mgmt_pending_cmds. Use commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth to inspect kernel logs for suspicious activity.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges by exploiting the UAF condition in Bluetooth management operations. Users relying on Bluetooth functionality may experience instability or security breaches.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel Bluetooth implementation issue. No evidence suggests data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel security advisories and apply patches as soon as they are available. If updating is not immediately possible, consider disabling Bluetooth functionality temporarily until the patch is applied.

Hi! I’m here to help you understand CVE-2026-68391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...