CVE-2026-68392

Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

State: Published
Severity: 7.8 High
Published: Aug 10, 2026
Updated: Aug 23, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF.

Take hdev->lock for hci_conn lookup and hci_abort_conn(). Don't use RCU to ensure the conn is fully initialized at this point.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7fe4d391e937c2f048a43ff4b421e677f10d83c0 to before 74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82Affected 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c to before 8bc83f9ef6789571f399ff631a2a14a12b6d8585Affected 227a0cdf4a028a73dc256d0f5144b4808d718893 to before 579faba5ede6df6b7f36777c431dc8dcf9d272e7Affected 227a0cdf4a028a73dc256d0f5144b4808d718893 to before ca58ad287bfc5b9d31a72ecb8650289df2b57250Affected 227a0cdf4a028a73dc256d0f5144b4808d718893 to before b11511006f9e17000de3f4cadee451364f658ca3Affected 227a0cdf4a028a73dc256d0f5144b4808d718893 to before 16cd66443957e4ad42155c6fec401012f600c6f8Affected 58afdc9b18871eb1d461c725be9e9f3f44a39aebAffected 6.6.51 to before 6.6.148Affected 6.10.10 to before 6.11Affected
LinuxLinux	6.11Affected before 6.11Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

7fe4d391e937c2f048a43ff4b421e677f10d83c0 to before 74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82Affected
249c88e7fb45b6b705040c5af4bd0d0f2bc9735c to before 8bc83f9ef6789571f399ff631a2a14a12b6d8585Affected
227a0cdf4a028a73dc256d0f5144b4808d718893 to before 579faba5ede6df6b7f36777c431dc8dcf9d272e7Affected
227a0cdf4a028a73dc256d0f5144b4808d718893 to before ca58ad287bfc5b9d31a72ecb8650289df2b57250Affected
227a0cdf4a028a73dc256d0f5144b4808d718893 to before b11511006f9e17000de3f4cadee451364f658ca3Affected
227a0cdf4a028a73dc256d0f5144b4808d718893 to before 16cd66443957e4ad42155c6fec401012f600c6f8Affected
58afdc9b18871eb1d461c725be9e9f3f44a39aebAffected
6.6.51 to before 6.6.148Affected
6.10.10 to before 6.11Affected

LinuxLinux

6.11Affected
before 6.11Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.