Cloudanix VulnDB

CVE-2026-68391

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the core software handling Bluetooth connections can let someone already on the device crash it or gain deep system control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free due to dereferencing RCU-protected hci_conn pointers outside critical sections and missing refcount holds in mgmt_pending_cmds and hci_sync callbacks, plus data races on conn->state without hdev->lock.

Why it matters to the business

Local attackers may crash systems or escalate privileges via kernel memory corruption in the Bluetooth stack, reducing device stability and exposing kernel-level control on affected Linux systems.

How an attack unfolds

A local attacker issues Bluetooth management commands that store hci_conn pointers without refcounts; later callbacks dereference the freed objects or access state without locks, triggering the UAF.

How to fix it

Update the Linux kernel to a version containing the referenced fix that adds refcount increments for hci_conn storage and proper locking around state accesses in the Bluetooth mgmt path.

How to confirm the fix worked

Confirm the patch by inspecting kernel sources for refcount_get/put on hci_conn in mgmt code paths and hdev->lock usage before conn->state reads; run Bluetooth regression tests after upgrade.

Typical attack path

  1. Obtain local user privileges on a Linux system
  2. Trigger Bluetooth mgmt operations that populate mgmt_pending_cmds
  3. Force hci_conn free while pointers remain in callbacks
  4. Dereference dangling pointers to corrupt kernel memory or execute code

How to detect it

Review kernel logs and crash dumps for Bluetooth mgmt or hci_conn related use-after-free warnings, RCU violations, or data-race reports; correlate with processes issuing mgmt commands.

What your security team should do

  • Prioritize kernel updates for systems exposing Bluetooth
  • Apply kernel hardening options that detect refcount misuse
  • Limit untrusted local access to Bluetooth interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.

Affected packages

Ecosystem Package Introduced Fixed