CVE-2026-68389

Received Received - Intake

Bluetooth: hci_qca Memory Corruption in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump state on invalid dump size qca_controller_memdump() allocates qca->qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size. If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca->qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca->qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump. Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails. A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68389

EUVD

EUVD-2026-55575

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Bluetooth-related vulnerability in the Linux kernel where a memory dump state is not properly cleared when an invalid dump size is reported by the controller. This can lead to use-after-free and stale state issues in the Bluetooth subsystem.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and cannot be directly detected via network commands. Check kernel logs for Bluetooth-related errors or crashes using 'dmesg | grep -i bluetooth' or 'journalctl -k | grep -i bluetooth'. If memdump issues occur, look for related errors in system logs.

Impact Analysis

The vulnerability may cause system instability, crashes, or unexpected behavior in Bluetooth operations. It could also lead to security issues due to improper memory handling and potential privilege escalation if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory management issue in the Linux kernel's Bluetooth subsystem that could lead to system instability or crashes but does not involve data exposure or unauthorized access.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-68389. Monitor kernel updates from your distribution and apply them promptly. No additional configuration changes are required beyond the kernel update.

Hi! I’m here to help you understand CVE-2026-68389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70