Cloudanix VulnDB

CVE-2026-68393

High · 8.8

CVSS

8.8

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in how Linux handles Bluetooth connections could let a nearby attacker crash the system or potentially run malicious code.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Medium

What it actually does

Use-after-free in Linux kernel Bluetooth hci_sync when RCU-protected conn_hash pointers are dereferenced outside critical sections without refcount protection, allowing concurrent deletion of connection objects; also requires holding hdev lock for accept_list access.

Why it matters to the business

Linux-based systems using Bluetooth face risk of crashes, memory corruption, or potential remote code execution by nearby attackers, which can disrupt device operation, require emergency patching, and expose sensitive data or enable lateral movement in environments with wireless peripherals.

How an attack unfolds

An attacker within Bluetooth range triggers concurrent HCI connection operations that race with conn_hash lookups; by forcing deletion of the connection object while it is still being dereferenced without proper RCU protection or locking, the attacker causes a use-after-free that can be leveraged for memory corruption or control-flow hijacking.

How to fix it

Update the Linux kernel to a version containing the commit that extends rcu_read_lock critical sections around hci_conn_hash lookups and ensures hdev lock protection for accept_list; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the presence of the upstream fix commit in the running kernel source or package changelog; confirm no UAF warnings in kernel logs during Bluetooth activity and test that hci_sync paths now hold locks across both lookup and use.

Typical attack path

  1. Position a device within Bluetooth adjacency range of the target
  2. Initiate or manipulate LE or classic connection attempts to exercise hci_lookup and conn_hash paths
  3. Trigger concurrent deletion or list modification while the vulnerable dereference occurs outside the extended RCU section
  4. Exploit the resulting use-after-free for arbitrary read/write or code execution

How to detect it

Review kernel ring buffer and dmesg for Bluetooth HCI oops, slab-use-after-free warnings, or warnings referencing hci_conn_hash or hci_sync; correlate with Bluetooth connection events in audit logs and look for unexpected process crashes involving the Bluetooth stack.

  • UAF in hci_conn
  • rcu_read_lock missing around hci_conn_hash
  • hdev->accept_list access without hdev lock
  • kernel BUG at net/bluetooth/hci_sync.c

What your security team should do

  • Prioritize kernel updates on any Linux hosts exposing Bluetooth interfaces
  • Disable Bluetooth when not required until patches are applied
  • Monitor kernel logs for Bluetooth-related oops or UAF signatures
  • Apply defense-in-depth by restricting physical proximity to untrusted devices

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: extend conn_hash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hci_conn_hash lookup and use of the returned conn. Add surrounding rcu_read_lock() also when return value is not used, in preparation for RCU lockdep requirement to hci_lookup_le_connect(). This avoids concurrent deletion of the conn before we are done dereferencing it. Also, make sure to hold hdev->lock when accessing hdev->accept_list.

Affected packages

Ecosystem Package Introduced Fixed