CVE-2026-68389 (GCVE-0-2026-68389)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:04
VLAI
Title
Bluetooth: hci_qca: Clear memdump state on invalid dump size
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump state on invalid dump size qca_controller_memdump() allocates qca->qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size. If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca->qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca->qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump. Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails. A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 06d3fdfcdf5cefb06f2024b9d3dad356779399cf , < 5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a (git)
Affected: 06d3fdfcdf5cefb06f2024b9d3dad356779399cf , < 069258d5111eed9ac9586bee42d03d38e2975715 (git)
Affected: 06d3fdfcdf5cefb06f2024b9d3dad356779399cf , < cefb44c367b2b52e50f97bc8526d39df9bcf5e60 (git)
Affected: 06d3fdfcdf5cefb06f2024b9d3dad356779399cf , < 2363a757694752426fc47f3eadde15cf5f791fa5 (git)
Affected: 06d3fdfcdf5cefb06f2024b9d3dad356779399cf , < bf587a10c33e5571a299742e45bc18960b9912e7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_qca.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a",
              "status": "affected",
              "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
              "versionType": "git"
            },
            {
              "lessThan": "069258d5111eed9ac9586bee42d03d38e2975715",
              "status": "affected",
              "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
              "versionType": "git"
            },
            {
              "lessThan": "cefb44c367b2b52e50f97bc8526d39df9bcf5e60",
              "status": "affected",
              "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
              "versionType": "git"
            },
            {
              "lessThan": "2363a757694752426fc47f3eadde15cf5f791fa5",
              "status": "affected",
              "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
              "versionType": "git"
            },
            {
              "lessThan": "bf587a10c33e5571a299742e45bc18960b9912e7",
              "status": "affected",
              "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/hci_qca.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_qca: Clear memdump state on invalid dump size\n\nqca_controller_memdump() allocates qca-\u003eqca_memdump before processing\nthe first dump packet. For a sequence-zero packet it then disables IBS,\nmarks memdump collection active, and reads the advertised dump size.\n\nIf the controller reports a zero dump size, the error path frees the\nlocal qca_memdump object and returns without clearing qca-\u003eqca_memdump\nor undoing the collection state. A later memdump work item initializes\nits local pointer from qca-\u003eqca_memdump and skips allocation when that\npointer is non-NULL, so it can operate on freed memory. The stale\ncollection and IBS-disabled flags can also leave waiters or later\ntransmit handling blocked behind an aborted dump.\n\nClear the saved pointer and memdump state before returning from the\ninvalid-size path, matching the cleanup used when hci_devcd_init() fails.\n\nA static analysis checker reported the stale memdump state, and manual\nsource review confirmed the invalid-size failure path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable memdump packets arrive as QCA vendor HCI events (QCA_SSR_DUMP_HANDLE) emitted by the Bluetooth controller after a firmware crash/SSR, a state a nearby attacker induces or controls by attacking QCA controller firmware over the radio link, matching the CNA convention of scoring controller-event-driven Bluetooth driver bugs as Adjacent.\nAC:L - An attacker controlling the controller-to-host HCI stream deterministically triggers the flaw by sending a sequence-0 memdump packet with dump_size 0 followed by any further memdump packet; there is no race and no attacker-uncontrollable timing or memory-layout precondition.\nPR:N - No host credentials or authentication are needed: the memdump event is consumed unconditionally by qca_recv_event() on the driver receive path with no pairing, bonding, or capability check before qca_controller_memdump() runs.\nUI:N - SSR/memdump handling is fully automatic \u2014 qca_controller_memdump_event() queues the work item on receipt, so no local user has to open, mount, or confirm anything.\nS:U - The dangling pointer, use-after-free writes, and double free all occur in the host kernel\u0027s own heap and authority; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - The stale qca-\u003eqca_memdump gives a use-after-free on a kmalloc-16 object that an attacker can reclaim with another kernel allocation, and the freed fields (received_dump/ram_dump_size) then drive hci_devcd_append() length arithmetic, yielding attacker-influenced kernel memory disclosure per UAF exploitation.\nI:H - The reused freed object receives attacker-supplied 32-bit values (ram_dump_size straight from the packet, plus current_seq_no/received_dump) and is later kfree()d again, providing a controlled heap write and double-free primitive usable for arbitrary write and control-flow hijack.\nA:H - Beyond the use-after-free/double-free oops (KASAN slab-use-after-free), the uncleared QCA_MEMDUMP_COLLECTION and QCA_IBS_DISABLED flags leave wait_on_bit_timeout() waiters and the IBS transmit path stalled behind an aborted dump, persistently wedging the Bluetooth device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:36.839Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/069258d5111eed9ac9586bee42d03d38e2975715"
        },
        {
          "url": "https://git.kernel.org/stable/c/cefb44c367b2b52e50f97bc8526d39df9bcf5e60"
        },
        {
          "url": "https://git.kernel.org/stable/c/2363a757694752426fc47f3eadde15cf5f791fa5"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf587a10c33e5571a299742e45bc18960b9912e7"
        }
      ],
      "title": "Bluetooth: hci_qca: Clear memdump state on invalid dump size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68389",
    "datePublished": "2026-08-10T12:04:08.306Z",
    "dateReserved": "2026-07-30T09:28:09.388Z",
    "dateUpdated": "2026-08-17T05:04:36.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68389",
      "date": "2026-09-21",
      "epss": "0.00254",
      "percentile": "0.17155"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/hci_qca.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a",
                    "status": "affected",
                    "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "069258d5111eed9ac9586bee42d03d38e2975715",
                    "status": "affected",
                    "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cefb44c367b2b52e50f97bc8526d39df9bcf5e60",
                    "status": "affected",
                    "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2363a757694752426fc47f3eadde15cf5f791fa5",
                    "status": "affected",
                    "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf587a10c33e5571a299742e45bc18960b9912e7",
                    "status": "affected",
                    "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/bluetooth/hci_qca.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_qca: Clear memdump state on invalid dump size\n\nqca_controller_memdump() allocates qca-\u003eqca_memdump before processing\nthe first dump packet. For a sequence-zero packet it then disables IBS,\nmarks memdump collection active, and reads the advertised dump size.\n\nIf the controller reports a zero dump size, the error path frees the\nlocal qca_memdump object and returns without clearing qca-\u003eqca_memdump\nor undoing the collection state. A later memdump work item initializes\nits local pointer from qca-\u003eqca_memdump and skips allocation when that\npointer is non-NULL, so it can operate on freed memory. The stale\ncollection and IBS-disabled flags can also leave waiters or later\ntransmit handling blocked behind an aborted dump.\n\nClear the saved pointer and memdump state before returning from the\ninvalid-size path, matching the cleanup used when hci_devcd_init() fails.\n\nA static analysis checker reported the stale memdump state, and manual\nsource review confirmed the invalid-size failure path."
          }
        ],
        "id": "CVE-2026-68389",
        "lastModified": "2026-08-17T06:17:47.520",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:32.200",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/069258d5111eed9ac9586bee42d03d38e2975715"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2363a757694752426fc47f3eadde15cf5f791fa5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf587a10c33e5571a299742e45bc18960b9912e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cefb44c367b2b52e50f97bc8526d39df9bcf5e60"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:24:08+00:00",
      "cve": "CVE-2026-68389",
      "id": "CVE-2026-68389",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_qca: Clear memdump state on invalid dump size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68389.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-21T16:43:15Z",
      "cve": "CVE-2026-68389",
      "id": "CVE-2026-68389",
      "initial_release_date": "2026-08-13T16:22:42Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "354",
      "product_status:recommended": "83",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68389",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68389.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.