CVE-2026-68391 (GCVE-0-2026-68391)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:04
VLAI
Title
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7b445e220db9a2c58be5d09bbbd322abf1b1452a , < b56f2ecafc08f372bf0529f9c4f3f429cb1702dc (git)
Affected: 7b445e220db9a2c58be5d09bbbd322abf1b1452a , < f915e74b6f18293d1d69a2a3305ef321ff7c0172 (git)
Affected: 7b445e220db9a2c58be5d09bbbd322abf1b1452a , < d5b3b484b62bb0f4542e7622789d28871626cdf0 (git)
Affected: 7b445e220db9a2c58be5d09bbbd322abf1b1452a , < ecdcb55ea1c01dda074406f38058785a69526734 (git)
Affected: 7b445e220db9a2c58be5d09bbbd322abf1b1452a , < da55f570191d5d72f10c607a7043b947eb05ea46 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b56f2ecafc08f372bf0529f9c4f3f429cb1702dc",
              "status": "affected",
              "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
              "versionType": "git"
            },
            {
              "lessThan": "f915e74b6f18293d1d69a2a3305ef321ff7c0172",
              "status": "affected",
              "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
              "versionType": "git"
            },
            {
              "lessThan": "d5b3b484b62bb0f4542e7622789d28871626cdf0",
              "status": "affected",
              "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
              "versionType": "git"
            },
            {
              "lessThan": "ecdcb55ea1c01dda074406f38058785a69526734",
              "status": "affected",
              "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
              "versionType": "git"
            },
            {
              "lessThan": "da55f570191d5d72f10c607a7043b947eb05ea46",
              "status": "affected",
              "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds\n\nDereferencing RCU-protected pointers outside critical sections is\ninvalid and may lead to UAF.  Use of hci_conn in hci_sync callbacks also\nneeds to hold refcount to avoid UAF.\n\nTake appropriate locks for hci_conn lookups, and take refcount for\nhci_conn pointers stored in mgmt_pending_cmd so that the pointer stays\nvalid.\n\nWhen accessing conn-\u003estate, ensure hdev-\u003elock is held to avoid data\nrace."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both sides of the race are local: the vulnerable path is entered only by writing MGMT_OP_GET_CONN_INFO/MGMT_OP_GET_CLOCK_INFO to an AF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL, and the free is driven by a local disconnect/device-teardown. A remote or adjacent Bluetooth peer cannot inject mgmt commands, so the vector is local even though the subsystem is Bluetooth.\nAC:L - The attacker owns both sides of the race: one thread loops GET_CONN_INFO/GET_CLOCK_INFO, whose sync callback blocks in __hci_cmd_sync waiting on the controller for up to HCI_CMD_TIMEOUT, while another issues MGMT_OP_DISCONNECT or HCIDEVDOWN to free the hci_conn inside that wide window; with an emulated controller the response timing is fully controlled, and the sequence can be retried indefinitely.\nPR:L - The opcodes lack HCI_MGMT_UNTRUSTED so they need a trusted mgmt socket (CAP_NET_ADMIN), which kernel CNA practice for the Bluetooth mgmt interface treats as low privilege: it is a delegable capability held by the non-root bluetoothd service account and Android\u0027s sandboxed Bluetooth process rather than full init-namespace root.\nUI:N - The attacker performs every step itself \u2014 queueing the mgmt command and tearing down the connection or the HCI index \u2014 with no victim action, pairing, or user-initiated Bluetooth operation required.\nS:U - The use-after-free and the resulting heap corruption stay entirely within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - get_conn_info_complete()/get_clock_info_complete() read rssi, tx_power, max_tx_power, clock and clock_accuracy from a freed hci_conn and return them to userspace over the mgmt socket; hci_conn comes from a general-purpose kmalloc cache, so grooming the reclaimed slab turns this into a repeatable kernel-memory disclosure oracle.\nI:H - The dangling cmd-\u003euser_data points at a freed, sprayable struct-device-embedded object that can be reclaimed with attacker-shaped data and is later put/released, and the unlocked lookup also propagates a stale conn-\u003ehandle into hci_read_rssi_sync/hci_read_clock_sync so the host acts on a handle that may have been reused by another link \u2014 sufficient for controlled corruption after heap grooming.\nA:H - Dereferencing the freed hci_conn in the hci_cmd_sync completion callback is a slab use-after-free that produces a KASAN splat and can oops or panic the kernel when the slab has been returned to the page allocator, and it can be re-triggered in a loop for sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:39.043Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b56f2ecafc08f372bf0529f9c4f3f429cb1702dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f915e74b6f18293d1d69a2a3305ef321ff7c0172"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5b3b484b62bb0f4542e7622789d28871626cdf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecdcb55ea1c01dda074406f38058785a69526734"
        },
        {
          "url": "https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46"
        }
      ],
      "title": "Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68391",
    "datePublished": "2026-08-10T12:04:10.564Z",
    "dateReserved": "2026-07-30T09:28:09.388Z",
    "dateUpdated": "2026-08-17T05:04:39.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68391",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02871"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/mgmt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b56f2ecafc08f372bf0529f9c4f3f429cb1702dc",
                    "status": "affected",
                    "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f915e74b6f18293d1d69a2a3305ef321ff7c0172",
                    "status": "affected",
                    "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d5b3b484b62bb0f4542e7622789d28871626cdf0",
                    "status": "affected",
                    "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ecdcb55ea1c01dda074406f38058785a69526734",
                    "status": "affected",
                    "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da55f570191d5d72f10c607a7043b947eb05ea46",
                    "status": "affected",
                    "version": "7b445e220db9a2c58be5d09bbbd322abf1b1452a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/mgmt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.0"
                  },
                  {
                    "lessThan": "6.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds\n\nDereferencing RCU-protected pointers outside critical sections is\ninvalid and may lead to UAF.  Use of hci_conn in hci_sync callbacks also\nneeds to hold refcount to avoid UAF.\n\nTake appropriate locks for hci_conn lookups, and take refcount for\nhci_conn pointers stored in mgmt_pending_cmd so that the pointer stays\nvalid.\n\nWhen accessing conn-\u003estate, ensure hdev-\u003elock is held to avoid data\nrace."
          }
        ],
        "id": "CVE-2026-68391",
        "lastModified": "2026-08-17T06:17:47.743",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:32.433",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b56f2ecafc08f372bf0529f9c4f3f429cb1702dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d5b3b484b62bb0f4542e7622789d28871626cdf0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ecdcb55ea1c01dda074406f38058785a69526734"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f915e74b6f18293d1d69a2a3305ef321ff7c0172"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:28:20+00:00",
      "cve": "CVE-2026-68391",
      "id": "CVE-2026-68391",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68391.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:30:55Z",
      "cve": "CVE-2026-68391",
      "id": "CVE-2026-68391",
      "initial_release_date": "2026-08-13T16:22:38Z",
      "product_status:known_affected": "482",
      "product_status:known_not_affected": "249",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68391",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68391.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.