CVE-2026-68390: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcisync: hold hdev->lock for hciconnparams lookups
hciconnparamslookup requires hdev->lock be held, otherwise the list iteration or param access is not safe.
Hold hdev->lock for params lookups in hcisync.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68390?
CVE-2026-68390 has a risk rating of 27, indicating a significant vulnerability within the Linux kernel's Bluetooth implementation.
How do I fix CVE-2026-68390?
To fix CVE-2026-68390, update the Linux kernel to the latest version that includes the necessary patches for this vulnerability.
What systems are affected by CVE-2026-68390?
CVE-2026-68390 affects the Bluetooth subsystem of the Linux kernel across various distributions that utilize the vulnerable kernel version.
What does CVE-2026-68390 impact?
CVE-2026-68390 impacts the safe iteration and access of Bluetooth connection parameters due to improper locking mechanisms.
Is CVE-2026-68390 actively exploited?
As of now, there are no public reports indicating that CVE-2026-68390 is actively being exploited in the wild.