CVE-2026-68392

What it actually does

Use-after-free in the Linux kernel Bluetooth management layer caused by reading RCU-protected hci_conn pointers outside the required critical section during unpair_device and disconnect_sync operations, allowing invalid memory access after the object lifetime ends.

Why it matters to the business

Local attackers on affected Linux systems can achieve arbitrary code execution or kernel panic, leading to full host compromise, data theft, or denial of service on any device exposing Bluetooth management interfaces.

How an attack unfolds

An attacker with local user privileges invokes unpair or disconnect operations through the management socket while racing with connection teardown; the missing lock allows dereference of a freed hci_conn structure, enabling controlled memory corruption and privilege escalation.

How to fix it

Apply the upstream kernel commit that adds hdev->lock protection around hci_conn lookup and hci_abort_conn calls; rebuild and deploy the patched kernel across all affected distributions.

How to confirm the fix worked

Confirm the fix is present by inspecting the mgmt.c source for the added spin_lock/unlock around the lookup and abort paths; test by exercising unpair and disconnect under load and verifying absence of UAF warnings in kernel logs.

Typical attack path

1. Obtain local shell on target Linux system
2. Open Bluetooth management socket and issue unpair_device or disconnect command
3. Trigger concurrent connection state changes to race the RCU lookup
4. Dereference freed hci_conn object to corrupt kernel memory
5. Escalate to kernel code execution or crash the system

How to detect it

Review kernel logs for Bluetooth management errors or RCU stalls around unpair/disconnect operations; correlate with process execution of tools that open /dev/rfkill or mgmt sockets.

What your security team should do

• Prioritize kernel updates on all multi-user or Bluetooth-enabled Linux hosts within the next patch cycle
• Restrict unprivileged access to the Bluetooth management socket via AppArmor or SELinux policies where feasible
• Monitor kernel logs for Bluetooth-related UAF or RCU warnings as an interim detection measure