CVE-2026-68391: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds
Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoid UAF.
Take appropriate locks for hciconn lookups, and take refcount for hciconn pointers stored in mgmtpendingcmd so that the pointer stays valid.
When accessing conn->state, ensure hdev->lock is held to avoid data race.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68391?
The severity of CVE-2026-68391 is rated at 47.
What systems are affected by CVE-2026-68391?
CVE-2026-68391 affects the Linux Kernel, specifically components related to Bluetooth management.
How do I fix CVE-2026-68391?
To fix CVE-2026-68391, ensure that your Linux Kernel is updated to incorporate the necessary patches.
What is the nature of the vulnerability in CVE-2026-68391?
CVE-2026-68391 involves dereferencing RCU-protected pointers outside of critical sections, which may lead to use-after-free (UAF) conditions.
Has CVE-2026-68391 been publicly disclosed?
Yes, CVE-2026-68391 was published on August 10, 2026.