Linux Kernel Bluetooth Management Vulnerability on hci_conn Reference Handling

CVE-2026-68391

What is CVE-2026-68391?

A vulnerability in the Bluetooth management module of the Linux kernel allows for potential use-after-free (UAF) conditions due to improper reference handling of the hci_conn object. Specifically, when dereferencing RCU-protected pointers outside of critical sections, there is a risk of accessing invalid memory locations. This situation can be exacerbated if the hci_conn reference is not appropriately managed during hci_sync callbacks. It is crucial to ensure that refcounts are maintained when manipulating hci_conn pointers in mgmt_pending_cmd, and that proper locking mechanisms are employed during hci_conn lookups to mitigate data race conditions when accessing connection states.

References