CVE-2026-68393Bluetooth: hci_sync: extend conn_hash lookup critical sections
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: extend conn_hash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hci_conn_hash lookup and use of the returned conn. Add surrounding rcu_read_lock() also when return value is not used, in preparation for RCU lockdep requirement to hci_lookup_le_connect(). This avoids concurrent deletion of the conn before we are done dereferencing it. Also, make sure to hold hdev->lock when accessing hdev->accept_list.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 6d0417e4e1cf66fd917f06f0454958362714ef7d before 83b7e67698d0b93f685875ce82c8d335436834f7; from 6d0417e4e1cf66fd917f06f0454958362714ef7d before 38326774df6198df0cc2744cc73bf77cb741c538; from 6d0417e4e1cf66fd917f06f0454958362714ef7d before d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d; eb8b860e87b296bd1874c79a668081efd00f9754; 94bf6380e936339a700c0b3171a49baf512aa70b; from 6.12.28 before 6.13; from 6.14.6 before 6.15 | CNA record |
References
- https://git.kernel.org/stable/c/83b7e67698d0b93f685875ce82c8d335436834f7
- https://git.kernel.org/stable/c/38326774df6198df0cc2744cc73bf77cb741c538
- https://git.kernel.org/stable/c/d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.