{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68394", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.389Z", "datePublished": "2026-08-10T12:04:13.562Z", "dateUpdated": "2026-08-13T22:44:26.836Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-13T22:44:26.836Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update\n\nMGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter\nupdate changes an existing LE central connection. The queued work currently\nstores a borrowed hci_conn_params entry from hdev->le_conn_params. A later\nLOAD_CONN_PARAM request can clear disabled parameters and free that entry\nbefore hci_cmd_sync_work() runs the queued callback.\n\nDo not keep the borrowed hci_conn_params pointer in queued work. Queue the\nhci_conn instead and hold a reference until the queued callback completes.\nWhen the work runs, revalidate that the connection is still present, look\nup the current hci_conn_params entry, and cancel the update if userspace\nremoved that entry while the work was pending.\n\nCopy the interval values from the current params entry under hdev->lock,\nthen drop the lock and keep using hci_le_conn_update_sync() to issue the\nupdate.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth]\nRead of size 1 at addr ffff88810c697126 by task kworker/u17:0/377\nWorkqueue: hci0 hci_cmd_sync_work [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n kasan_report+0xe0/0x110\n conn_update_sync+0x2a/0xf0 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30\n\nAllocated by task 466:\n hci_conn_params_add+0xa6/0x240 [bluetooth]\n load_conn_param+0x4e1/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n\nFreed by task 474:\n kfree+0x313/0x590\n hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]\n load_conn_param+0x4bf/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered entirely through local interfaces \u2014 two MGMT_OP_LOAD_CONN_PARAM commands written to a local AF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL, reaching load_conn_param() via hci_sock_sendmsg()/hci_mgmt_cmd(). No over-the-air interaction from a remote Bluetooth peer is required.\nAC:L - The attacker controls both sides of the race: it issues the LOAD_CONN_PARAM that queues conn_update_sync() and then immediately issues a second LOAD_CONN_PARAM whose hci_conn_params_clear_disabled() frees the borrowed entry before hci_cmd_sync_work() dequeues it, and it can grool the slab by repeated hci_conn_params_add() calls.\nPR:L - Reaching load_conn_param() needs a trusted MGMT socket (CAP_NET_ADMIN at bind), which is exactly the privilege held by the unprivileged Bluetooth service account on Android and desktop Linux (bluetoothd / com.android.bluetooth) \u2014 a low-privilege, externally exposed daemon, not real root, and the standard scoring for MGMT-socket flaws.\nUI:N - Exploitation requires only that the attacker send its own MGMT commands over an existing LE central connection it can itself establish; no action by any other user or victim application is needed.\nS:U - The use-after-free corrupts kernel slab memory and its impact stays within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a slab use-after-free read: conn_update_sync() reads addr/addr_type and the four interval fields from a freed hci_conn_params and places them into the HCI_OP_LE_CONN_UPDATE command, leaking reallocated heap contents; more generally a UAF gives the attacker control over freed-object contents and can be leveraged into arbitrary kernel memory disclosure.\nI:H - The attacker grooms the freed hci_conn_params slot with controlled data, so freed memory dictates which connection is looked up and what parameters are programmed into the controller; a use-after-free of this kind is a standard primitive for heap manipulation and control-flow/data corruption in the kernel.\nA:H - The bug is a confirmed KASAN slab-use-after-free (BUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0) in a workqueue context, which panics on KASAN/panic_on_warn kernels and readily causes oopses or unpredictable Bluetooth-stack state otherwise."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/mgmt.c"], "versions": [{"version": "0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc", "lessThan": "65ce6fe1b92112ba9064ded932c03180da3dd230", "status": "affected", "versionType": "git"}, {"version": "0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc", "lessThan": "57059ff14d81df4a970b2ea8d8f54431bb91a025", "status": "affected", "versionType": "git"}, {"version": "0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc", "lessThan": "b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa", "status": "affected", "versionType": "git"}, {"version": "0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc", "lessThan": "2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/mgmt.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2-rc4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/65ce6fe1b92112ba9064ded932c03180da3dd230"}, {"url": "https://git.kernel.org/stable/c/57059ff14d81df4a970b2ea8d8f54431bb91a025"}, {"url": "https://git.kernel.org/stable/c/b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa"}, {"url": "https://git.kernel.org/stable/c/2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e"}], "title": "Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/mgmt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "65ce6fe1b92112ba9064ded932c03180da3dd230", "status": "affected", "version": "0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc", "versionType": "git"}, {"lessThan": "57059ff14d81df4a970b2ea8d8f54431bb91a025", "status": "affected", "version": "0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc", "versionType": "git"}, {"lessThan": "b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa", "status": "affected", "version": "0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc", "versionType": "git"}, {"lessThan": "2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e", "status": "affected", "version": "0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/mgmt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc4", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update\n\nMGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter\nupdate changes an existing LE central connection. The queued work currently\nstores a borrowed hci_conn_params entry from hdev->le_conn_params. A later\nLOAD_CONN_PARAM request can clear disabled parameters and free that entry\nbefore hci_cmd_sync_work() runs the queued callback.\n\nDo not keep the borrowed hci_conn_params pointer in queued work. Queue the\nhci_conn instead and hold a reference until the queued callback completes.\nWhen the work runs, revalidate that the connection is still present, look\nup the current hci_conn_params entry, and cancel the update if userspace\nremoved that entry while the work was pending.\n\nCopy the interval values from the current params entry under hdev->lock,\nthen drop the lock and keep using hci_le_conn_update_sync() to issue the\nupdate.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth]\nRead of size 1 at addr ffff88810c697126 by task kworker/u17:0/377\nWorkqueue: hci0 hci_cmd_sync_work [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n kasan_report+0xe0/0x110\n conn_update_sync+0x2a/0xf0 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30\n\nAllocated by task 466:\n hci_conn_params_add+0xa6/0x240 [bluetooth]\n load_conn_param+0x4e1/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n\nFreed by task 474:\n kfree+0x313/0x590\n hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]\n load_conn_param+0x4bf/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]"}], "id": "CVE-2026-68394", "lastModified": "2026-08-13T23:17:34.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:32.773", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57059ff14d81df4a970b2ea8d8f54431bb91a025"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/65ce6fe1b92112ba9064ded932c03180da3dd230"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Bluetooth MGMT use-after-free vulnerability", "id": "2513371", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513371"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update\nMGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter\nupdate changes an existing LE central connection. The queued work currently\nstores a borrowed hci_conn_params entry from hdev->le_conn_params. A later\nLOAD_CONN_PARAM request can clear disabled parameters and free that entry\nbefore hci_cmd_sync_work() runs the queued callback.\nDo not keep the borrowed hci_conn_params pointer in queued work. Queue the\nhci_conn instead and hold a reference until the queued callback completes.\nWhen the work runs, revalidate that the connection is still present, look\nup the current hci_conn_params entry, and cancel the update if userspace\nremoved that entry while the work was pending.\nCopy the interval values from the current params entry under hdev->lock,\nthen drop the lock and keep using hci_le_conn_update_sync() to issue the\nupdate.\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth]\nRead of size 1 at addr ffff88810c697126 by task kworker/u17:0/377\nWorkqueue: hci0 hci_cmd_sync_work [bluetooth]\nCall Trace:\n<TASK>\ndump_stack_lvl+0x66/0xa0\nprint_report+0xce/0x5f0\nkasan_report+0xe0/0x110\nconn_update_sync+0x2a/0xf0 [bluetooth]\nhci_cmd_sync_work+0x187/0x210 [bluetooth]\nprocess_one_work+0x4fd/0xbc0\nworker_thread+0x2d8/0x570\nkthread+0x1ad/0x1f0\nret_from_fork+0x3c9/0x540\nret_from_fork_asm+0x1a/0x30\nAllocated by task 466:\nhci_conn_params_add+0xa6/0x240 [bluetooth]\nload_conn_param+0x4e1/0x850 [bluetooth]\nhci_sock_sendmsg+0x96b/0xf80 [bluetooth]\nFreed by task 474:\nkfree+0x313/0x590\nhci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]\nload_conn_param+0x4bf/0x850 [bluetooth]\nhci_sock_sendmsg+0x96b/0xf80 [bluetooth]", "A flaw was found in the Bluetooth Management (MGMT) component of the Linux kernel. A use-after-free vulnerability occurs when the MGMT_OP_LOAD_CONN_PARAM operation queues a connection update. If a subsequent request frees the associated memory before the update is processed, it can lead to a system crash or potentially allow an attacker to execute arbitrary code."], "name": "CVE-2026-68394", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:04:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68394\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68394\nhttps://git.kernel.org/stable/c/2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e\nhttps://git.kernel.org/stable/c/57059ff14d81df4a970b2ea8d8f54431bb91a025\nhttps://git.kernel.org/stable/c/65ce6fe1b92112ba9064ded932c03180da3dd230\nhttps://git.kernel.org/stable/c/b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc,65ce6fe1b92112ba9064ded932c03180da3dd230)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc,57059ff14d81df4a970b2ea8d8f54431bb91a025)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc,b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc,2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T17:30:17.998234+00:00", "updated": "2026-08-14T01:15:17.090268+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}