CVE-2026-68391Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before 84674dd1d3192ecb050827d3148642609c0c9dbb; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before b56f2ecafc08f372bf0529f9c4f3f429cb1702dc; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before f915e74b6f18293d1d69a2a3305ef321ff7c0172; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before d5b3b484b62bb0f4542e7622789d28871626cdf0; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before ecdcb55ea1c01dda074406f38058785a69526734; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before da55f570191d5d72f10c607a7043b947eb05ea46 | CNA record |
References
- https://git.kernel.org/stable/c/84674dd1d3192ecb050827d3148642609c0c9dbb
- https://git.kernel.org/stable/c/b56f2ecafc08f372bf0529f9c4f3f429cb1702dc
- https://git.kernel.org/stable/c/f915e74b6f18293d1d69a2a3305ef321ff7c0172
- https://git.kernel.org/stable/c/d5b3b484b62bb0f4542e7622789d28871626cdf0
- https://git.kernel.org/stable/c/ecdcb55ea1c01dda074406f38058785a69526734
- https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.