Cloudanix VulnDB

CVE-2026-68394

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A programming error in the Linux Bluetooth code can let someone who already has access to the computer corrupt memory and potentially take full control or crash the machine.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Bluetooth MGMT handling where a borrowed hci_conn_params pointer stored in queued conn_update_sync work is freed by a subsequent LOAD_CONN_PARAM request before the hci_cmd_sync_work callback executes, allowing slab memory corruption on read.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption leading to crashes, privilege escalation, or system compromise, especially on devices relying on Bluetooth LE central connections; low but non-zero exploit probability increases urgency for kernel updates.

How an attack unfolds

A local process opens the HCI management socket and issues repeated LOAD_CONN_PARAM commands that queue connection parameter updates; a concurrent command clears the parameters, freeing the entry while the work item still references it, resulting in use-after-free when the worker runs hci_le_conn_update_sync.

How to fix it

Apply the upstream kernel patch that replaces the borrowed hci_conn_params pointer with a referenced hci_conn and revalidates the params entry under lock before performing the update; rebuild and reboot to the fixed kernel version.

How to confirm the fix worked

Verify the running kernel contains the commit fixing conn_update_sync to hold hci_conn reference and revalidate params; attempt to reproduce the KASAN report with crafted LOAD_CONN_PARAM sequences to confirm absence of use-after-free.

Typical attack path

  1. Open /dev/rfkill or HCI socket as local user
  2. Send MGMT_OP_LOAD_CONN_PARAM messages to add and then disable LE connection parameters
  3. Trigger hci_cmd_sync_work to dereference the now-freed hci_conn_params
  4. Achieve slab-use-after-free for memory corruption or information leak

How to detect it

Search kernel logs and dmesg for KASAN reports mentioning conn_update_sync, hci_cmd_sync_work, or slab-use-after-free in the bluetooth module; correlate with process activity using the management socket around the time of the crash.

  • BUG: KASAN: slab-use-after-free in conn_update_sync
  • conn_update_sync+0x2a/0xf0 [bluetooth]
  • hci_cmd_sync_work+0x187/0x210 [bluetooth]
  • hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]

What your security team should do

  • Prioritize kernel updates on all Bluetooth-enabled Linux hosts within standard patch windows
  • Disable Bluetooth kernel modules via modprobe blacklist if the feature is not required
  • Monitor kernel logs for KASAN or slab-use-after-free reports involving bluetooth and conn_update_sync
  • Restrict unprivileged access to HCI sockets through LSM or seccomp policies

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update MGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hci_conn_params entry from hdev->le_conn_params. A later LOAD_CONN_PARAM request can clear disabled parameters and free that entry before hci_cmd_sync_work() runs the queued callback. Do not keep the borrowed hci_conn_params pointer in queued work. Queue the hci_conn instead and hold a reference until the queued callback completes. When the work runs, revalidate that the connection is still present, look up the current hci_conn_params entry, and cancel the update if userspace removed that entry while the work was pending. Copy the interval values from the current params entry under hdev->lock, then drop the lock and keep using hci_le_conn_update_sync() to issue the update. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth] Read of size 1 at addr ffff88810c697126 by task kworker/u17:0/377 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x5f0 kasan_report+0xe0/0x110 conn_update_sync+0x2a/0xf0 [bluetooth] hci_cmd_sync_work+0x187/0x210 [bluetooth] process_one_work+0x4fd/0xbc0 worker_thread+0x2d8/0x570 kthread+0x1ad/0x1f0 ret_from_fork+0x3c9/0x540 ret_from_fork_asm+0x1a/0x30 Allocated by task 466: hci_conn_params_add+0xa6/0x240 [bluetooth] load_conn_param+0x4e1/0x850 [bluetooth] hci_sock_sendmsg+0x96b/0xf80 [bluetooth] Freed by task 474: kfree+0x313/0x590 hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth] load_conn_param+0x4bf/0x850 [bluetooth] hci_sock_sendmsg+0x96b/0xf80 [bluetooth]

Affected packages

Ecosystem Package Introduced Fixed