CVE-2026-68189

What it actually does

Use-after-free in kernel Bluetooth EIR generation when UUID list traversal under req_lock races with add_uuid/remove_uuid under hdev lock, allowing freed uuid structure access in eir_create.

Why it matters to the business

Linux systems using Bluetooth may experience kernel crashes, denial of service, or potential local privilege escalation; low exploitation likelihood reduces immediate operational risk despite 76 days of public exposure and declining EPSS trend.

How an attack unfolds

An attacker with local access sends rapid management socket commands to add and remove UUIDs while the hci_cmd_sync_work concurrently walks the list, triggering the use-after-free reported by KASAN in eir_create.

How to fix it

Update to a Linux kernel version containing the fix that holds hdev lock during UUID list snapshot generation and EIR creation; no downstream fixed versions supplied in advisory.

How to confirm the fix worked

Confirm kernel source contains the locking change around hci_update_eir_sync and eir_create paths; recompile, boot, and exercise concurrent UUID add/remove under management socket while monitoring for KASAN reports.

Typical attack path

1. Obtain local unprivileged access on a Linux host with Bluetooth enabled
2. Open HCI management socket and issue repeated add_uuid/remove_uuid operations
3. Trigger hci_cmd_sync_work via normal Bluetooth activity or crafted HCI commands
4. Race causes list_del and kfree on a uuid still referenced by the worker
5. Read from freed slab memory in eir_create leading to crash or controlled data access

How to detect it

Review kernel logs for KASAN use-after-free reports mentioning eir_create, hci_update_eir_sync, or hci_cmd_sync_work; correlate with processes performing frequent HCI management socket operations.

What your security team should do

• Prioritize kernel updates on multi-user or Bluetooth-enabled endpoints within standard patch cycles given low EPSS and absence from KEV
• Restrict unprivileged access to HCI management sockets via AppArmor or SELinux where Bluetooth is required
• Monitor for future EPSS increases or exploit maturity changes over the next 30 days