CVE-2026-68392

HighCVSS 7.8

Published: 10/08/2026(UTC)Updated: 23/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

In the Linux kernel's Bluetooth subsystem (mgmt), a locking issue was found in unpair_device and disconnect_sync. Dereferencing RCU-protected pointers outside critical sections can lead to use-after-free. The fix adds hdev->lock for hci_conn lookup and hci_abort_conn().

Risk Assessment

This could lead to system crashes or potentially arbitrary code execution in kernel context.

Recommendation

Install a Linux kernel update containing the fix that adds appropriate locks.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev->lock for hci_conn lookup and hci_abort_conn(). Don't use RCU to ensure the conn is fully initialized at this point.