UBUNTU-CVE-2026-68394: Use After Free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync() when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams entry from hdev->leconnparams. A later LOADCONNPARAM request can clear disabled parameters and free that entry before hcicmdsyncwork() runs the queued callback. Do not keep the borrowed hciconnparams pointer in queued work. Queue the hciconn instead and hold a reference until the queued callback completes. When the work runs, revalidate that the connection is still present, look up the current hciconnparams entry, and cancel the update if userspace removed that entry while the work was pending. Copy the interval values from the current params entry under hdev->lock, then drop the lock and keep using hcileconnupdatesync() to issue the update. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in connupdatesync+0x2a/0xf0 [bluetooth] Read of size 1 at addr ffff88810c697126 by task kworker/u17:0/377 Workqueue: hci0 hcicmdsyncwork [bluetooth] Call Trace: <TASK> dumpstacklvl+0x66/0xa0 printreport+0xce/0x5f0 kasanreport+0xe0/0x110 connupdatesync+0x2a/0xf0 [bluetooth] hcicmdsyncwork+0x187/0x210 [bluetooth] processonework+0x4fd/0xbc0 workerthread+0x2d8/0x570 kthread+0x1ad/0x1f0 retfromfork+0x3c9/0x540 retfromforkasm+0x1a/0x30 Allocated by task 466: hciconnparamsadd+0xa6/0x240 [bluetooth] loadconnparam+0x4e1/0x850 [bluetooth] hcisocksendmsg+0x96b/0xf80 [bluetooth] Freed by task 474: kfree+0x313/0x590 hciconnparamscleardisabled+0x9b/0xc0 [bluetooth] loadconnparam+0x4bf/0x850 [bluetooth] hcisocksendmsg+0x96b/0xf80 [bluetooth]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Fix Bluetooth MGMT_OP_LOAD_CONN_PARAM queued updates so they queue the hci_conn and hold a reference until the callback completes; copy interval values from the current hci_conn_params entry under hdev->lock, then release the lock and use hci_le_conn_update_sync(); do not retain a borrowed hci_conn_params pointer, and revalidate that the connection and current parameter entry still exist before applying the update, cancelling it if userspace removed the entry.
Event History
Frequently Asked Questions
What level of access is required to trigger this issue?
The vector is local and requires high privileges. Exploitation involves issuing MGMT_OP_LOAD_CONN_PARAM requests so that a queued LE connection-parameter update references an entry that is subsequently removed.
Which systems are exposed?
The affected Ubuntu software entries are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. The vulnerable path involves Bluetooth management handling for an existing LE central connection.
How might an affected system present the problem?
Validation reproduced a KASAN slab use-after-free in the Bluetooth conn_update_sync function. The failing work was reported in the hci_cmd_sync_work workqueue context.