CVE-2026-68391
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel's Bluetooth subsystem (mgmt), a vulnerability was found where hci_conn is not properly referenced in mgmt_pending_cmds. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds appropriate locks and refcounting.
Risk Assessment
This could lead to system crashes or potentially arbitrary code execution in kernel context.
Recommendation
Apply a Linux kernel update containing the fix that adds appropriate locks and refcounting.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.