CVE-2026-68391
Received Received - Intake

Bluetooth Use-After-Free in Linux Kernel Bluetooth Subsystem

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68391
EUVD
EUVD-2026-55577

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of Bluetooth management commands. It occurs when hci_conn pointers in mgmt_pending_cmds are dereferenced outside critical sections, leading to a use-after-free (UAF) condition. The issue requires holding appropriate locks and reference counts to ensure pointer validity and prevent data races.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth management subsystem. Detection requires checking kernel logs for Bluetooth-related errors or crashes, particularly involving hci_conn or mgmt_pending_cmds. Use commands like dmesg | grep -i bluetooth or journalctl -k | grep -i bluetooth to inspect kernel logs for suspicious activity.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges by exploiting the UAF condition in Bluetooth management operations. Users relying on Bluetooth functionality may experience instability or security breaches.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel security advisories and apply patches as soon as they are available. If updating is not immediately possible, consider disabling Bluetooth functionality temporarily until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68391. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart