CVE-2026-68391

Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

State: Published
Severity: 7.8 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF.

Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid.

When accessing conn->state, ensure hdev->lock is held to avoid data race.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	7b445e220db9a2c58be5d09bbbd322abf1b1452a to before 84674dd1d3192ecb050827d3148642609c0c9dbbAffected 7b445e220db9a2c58be5d09bbbd322abf1b1452a to before b56f2ecafc08f372bf0529f9c4f3f429cb1702dcAffected 7b445e220db9a2c58be5d09bbbd322abf1b1452a to before f915e74b6f18293d1d69a2a3305ef321ff7c0172Affected 7b445e220db9a2c58be5d09bbbd322abf1b1452a to before d5b3b484b62bb0f4542e7622789d28871626cdf0Affected 7b445e220db9a2c58be5d09bbbd322abf1b1452a to before ecdcb55ea1c01dda074406f38058785a69526734Affected 7b445e220db9a2c58be5d09bbbd322abf1b1452a to before da55f570191d5d72f10c607a7043b947eb05ea46Affected
LinuxLinux	6.0Affected before 6.0Not affected 6.1.189 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

7b445e220db9a2c58be5d09bbbd322abf1b1452a to before 84674dd1d3192ecb050827d3148642609c0c9dbbAffected
7b445e220db9a2c58be5d09bbbd322abf1b1452a to before b56f2ecafc08f372bf0529f9c4f3f429cb1702dcAffected
7b445e220db9a2c58be5d09bbbd322abf1b1452a to before f915e74b6f18293d1d69a2a3305ef321ff7c0172Affected
7b445e220db9a2c58be5d09bbbd322abf1b1452a to before d5b3b484b62bb0f4542e7622789d28871626cdf0Affected
7b445e220db9a2c58be5d09bbbd322abf1b1452a to before ecdcb55ea1c01dda074406f38058785a69526734Affected
7b445e220db9a2c58be5d09bbbd322abf1b1452a to before da55f570191d5d72f10c607a7043b947eb05ea46Affected

LinuxLinux

6.0Affected
before 6.0Not affected
6.1.189 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.