Linux Kernel Bluetooth Vulnerability Impacts Device Security

CVE-2026-68390

What is CVE-2026-68390?

A vulnerability has been identified in the Linux kernel's Bluetooth subsystem, specifically related to the improper handling of concurrency in parameter lookups. The issue arises in the hci_sync function, where the necessary lock (hdev->lock) is not held during hci_conn_params lookups. This oversight can lead to unsafe list iteration or parameter access, potentially compromising the integrity of Bluetooth connections and the overall security of affected devices. Mitigations have been implemented to address the issue, ensuring that hdev->lock is properly held during these operations.

References