{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68392","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.388Z","datePublished":"2026-08-10T12:04:11.543Z","dateUpdated":"2026-08-23T12:46:21.017Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-23T12:46:21.017Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix locking in unpair_device/disconnect_sync\n\nDereferencing RCU-protected pointers outside critical sections is\ninvalid and may lead to UAF.\n\nTake hdev->lock for hci_conn lookup and hci_abort_conn().  Don't use RCU\nto ensure the conn is fully initialized at this point."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is entered by a local process sending MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR_DEVICE on an AF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL, and the freeing side is drivable locally via /dev/vhci events or ioctl(HCIDEVDOWN)/hci_conn_hash_flush; no over-the-air access is required.\nAC:L - The attacker controls both sides of the race — repeatedly queuing the mgmt command while tearing the connection down (vhci-injected disconnect-complete, HCIDEVDOWN, or connection timeout) — and can retry indefinitely, so the window is reached reliably.\nPR:L - The mgmt command needs a trusted control socket, but that capability is routinely held by the Bluetooth daemon and exposed to unprivileged session users through BlueZ Disconnect/RemoveDevice D-Bus methods, so an ordinary local user can drive the path with attacker-chosen addresses.\nUI:N - Both the mgmt command and the concurrent connection teardown are initiated programmatically by the attacker; no victim action such as pairing confirmation or opening a file is needed.\nS:U - The corruption is confined to kernel heap objects managed by the Bluetooth subsystem within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - hci_abort_conn() dereferences the freed hci_conn (conn->hdev, conn->abort_reason, conn->handle) after it has been unlinked and released, so an attacker who reclaims the slab with controlled data obtains a read primitive over kernel memory and can leak pointers.\nI:H - The use-after-free is not read-only: hci_abort_conn() stores the attacker-reachable reason byte into conn->abort_reason and hci_conn_get() increments a refcount inside the freed object, giving a write primitive into reclaimed heap memory that is leverageable for control-flow hijack.\nA:H - Dereferencing a freed or partially initialized hci_conn and then queuing abort_conn_sync on it produces slab-use-after-free oopses, refcount underflow, and kernel panics, crashing the system."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"],"versions":[{"version":"7fe4d391e937c2f048a43ff4b421e677f10d83c0","lessThan":"74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82","status":"affected","versionType":"git"},{"version":"249c88e7fb45b6b705040c5af4bd0d0f2bc9735c","lessThan":"8bc83f9ef6789571f399ff631a2a14a12b6d8585","status":"affected","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","lessThan":"579faba5ede6df6b7f36777c431dc8dcf9d272e7","status":"affected","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","lessThan":"ca58ad287bfc5b9d31a72ecb8650289df2b57250","status":"affected","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","lessThan":"b11511006f9e17000de3f4cadee451364f658ca3","status":"affected","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","lessThan":"16cd66443957e4ad42155c6fec401012f600c6f8","status":"affected","versionType":"git"},{"version":"58afdc9b18871eb1d461c725be9e9f3f44a39aeb","status":"affected","versionType":"git"},{"version":"6.6.51","lessThan":"6.6.148","status":"affected","versionType":"semver"},{"version":"6.10.10","lessThan":"6.11","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.51","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10.10"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82"},{"url":"https://git.kernel.org/stable/c/8bc83f9ef6789571f399ff631a2a14a12b6d8585"},{"url":"https://git.kernel.org/stable/c/579faba5ede6df6b7f36777c431dc8dcf9d272e7"},{"url":"https://git.kernel.org/stable/c/ca58ad287bfc5b9d31a72ecb8650289df2b57250"},{"url":"https://git.kernel.org/stable/c/b11511006f9e17000de3f4cadee451364f658ca3"},{"url":"https://git.kernel.org/stable/c/16cd66443957e4ad42155c6fec401012f600c6f8"}],"title":"Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync","x_generator":{"engine":"bippy-1.2.0"}}}}