CVE-2026-68394: Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: revalidate LOADCONNPARAM queued update
MGMTOPLOADCONNPARAM queues connupdatesync() when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams entry from hdev->leconnparams. A later LOADCONNPARAM request can clear disabled parameters and free that entry before hcicmdsyncwork() runs the queued callback.
Do not keep the borrowed hciconnparams pointer in queued work. Queue the hciconn instead and hold a reference until the queued callback completes. When the work runs, revalidate that the connection is still present, look up the current hciconnparams entry, and cancel the update if userspace removed that entry while the work was pending.
Copy the interval values from the current params entry under hdev->lock, then drop the lock and keep using hcileconnupdatesync() to issue the update.
Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in connupdatesync+0x2a/0xf0 [bluetooth] Read of size 1 at addr ffff88810c697126 by task kworker/u17:0/377 Workqueue: hci0 hcicmdsyncwork [bluetooth]
Call Trace: <TASK> dumpstacklvl+0x66/0xa0 printreport+0xce/0x5f0 kasanreport+0xe0/0x110 connupdatesync+0x2a/0xf0 [bluetooth] hcicmdsyncwork+0x187/0x210 [bluetooth] processonework+0x4fd/0xbc0 workerthread+0x2d8/0x570 kthread+0x1ad/0x1f0 retfromfork+0x3c9/0x540 retfromforkasm+0x1a/0x30
Allocated by task 466: hciconnparamsadd+0xa6/0x240 [bluetooth] loadconnparam+0x4e1/0x850 [bluetooth] hcisocksendmsg+0x96b/0xf80 [bluetooth]
Freed by task 474: kfree+0x313/0x590 hciconnparamscleardisabled+0x9b/0xc0 [bluetooth] loadconnparam+0x4bf/0x850 [bluetooth] hcisocksendmsg+0x96b/0xf80 [bluetooth]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the kernel fix for the bluetooth LOAD_CONN_PARAM use-after-free described (queue conn_update_sync safely by revalidating that the connection still exists before running the queued callback, and do not keep a borrowed hci_conn_params pointer in queued work).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68394?
The severity of CVE-2026-68394 is categorized as a risk level of 38.
How do I fix CVE-2026-68394?
To fix CVE-2026-68394, update the Linux kernel to a version that includes the security patch addressing this issue.
What type of vulnerability is CVE-2026-68394?
CVE-2026-68394 is a use-after-free vulnerability in the Linux kernel's Bluetooth management.
What software is affected by CVE-2026-68394?
CVE-2026-68394 affects the Linux kernel, specifically in relation to Bluetooth management operations.
When was CVE-2026-68394 published?
CVE-2026-68394 was published on August 10, 2026.