CVE-2026-68390

Received Received - Intake

Bluetooth: hci_sync Locking Issue in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups hci_conn_params_lookup requires hdev->lock be held, otherwise the list iteration or param access is not safe. Hold hdev->lock for params lookups in hci_sync.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68390

EUVD

EUVD-2026-55576

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the Bluetooth subsystem. It involves a missing lock when accessing connection parameters in the hci_sync component. The hdev->lock must be held during hci_conn_params lookups to prevent unsafe list iteration or parameter access.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and requires kernel-level detection. There are no direct network commands to detect it. Check if your kernel version includes the fix by running uname -a and comparing against patched versions. Monitor kernel logs for Bluetooth-related crashes or warnings using dmesg | grep -i bluetooth. If you suspect exploitation, inspect hci_conn_params structures in kernel memory, but this requires advanced debugging tools.

Impact Analysis

This could lead to race conditions in Bluetooth operations, potentially causing memory corruption, crashes, or unexpected behavior in Bluetooth functionality. It may also allow unauthorized access or data leaks if exploited.

Compliance Impact

This vulnerability is specific to the Linux kernel's Bluetooth subsystem and does not directly impact compliance with standards like GDPR or HIPAA. It involves a race condition in Bluetooth connection parameter handling, which could lead to memory corruption or undefined behavior in the kernel. However, no evidence suggests it affects data privacy or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the Bluetooth hci_sync vulnerability. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-68390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70