{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68394","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.389Z","datePublished":"2026-08-10T12:04:13.562Z","dateUpdated":"2026-08-17T05:04:42.328Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:04:42.328Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update\n\nMGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter\nupdate changes an existing LE central connection. The queued work currently\nstores a borrowed hci_conn_params entry from hdev->le_conn_params. A later\nLOAD_CONN_PARAM request can clear disabled parameters and free that entry\nbefore hci_cmd_sync_work() runs the queued callback.\n\nDo not keep the borrowed hci_conn_params pointer in queued work. Queue the\nhci_conn instead and hold a reference until the queued callback completes.\nWhen the work runs, revalidate that the connection is still present, look\nup the current hci_conn_params entry, and cancel the update if userspace\nremoved that entry while the work was pending.\n\nCopy the interval values from the current params entry under hdev->lock,\nthen drop the lock and keep using hci_le_conn_update_sync() to issue the\nupdate.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth]\nRead of size 1 at addr ffff88810c697126 by task kworker/u17:0/377\nWorkqueue: hci0 hci_cmd_sync_work [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n kasan_report+0xe0/0x110\n conn_update_sync+0x2a/0xf0 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30\n\nAllocated by task 466:\n hci_conn_params_add+0xa6/0x240 [bluetooth]\n load_conn_param+0x4e1/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n\nFreed by task 474:\n kfree+0x313/0x590\n hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]\n load_conn_param+0x4bf/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is triggered entirely through local interfaces — two MGMT_OP_LOAD_CONN_PARAM commands written to a local AF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL, reaching load_conn_param() via hci_sock_sendmsg()/hci_mgmt_cmd(). No over-the-air interaction from a remote Bluetooth peer is required.\nAC:L - The attacker controls both sides of the race: it issues the LOAD_CONN_PARAM that queues conn_update_sync() and then immediately issues a second LOAD_CONN_PARAM whose hci_conn_params_clear_disabled() frees the borrowed entry before hci_cmd_sync_work() dequeues it, and it can grool the slab by repeated hci_conn_params_add() calls.\nPR:L - Reaching load_conn_param() needs a trusted MGMT socket (CAP_NET_ADMIN at bind), which is exactly the privilege held by the unprivileged Bluetooth service account on Android and desktop Linux (bluetoothd / com.android.bluetooth) — a low-privilege, externally exposed daemon, not real root, and the standard scoring for MGMT-socket flaws.\nUI:N - Exploitation requires only that the attacker send its own MGMT commands over an existing LE central connection it can itself establish; no action by any other user or victim application is needed.\nS:U - The use-after-free corrupts kernel slab memory and its impact stays within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a slab use-after-free read: conn_update_sync() reads addr/addr_type and the four interval fields from a freed hci_conn_params and places them into the HCI_OP_LE_CONN_UPDATE command, leaking reallocated heap contents; more generally a UAF gives the attacker control over freed-object contents and can be leveraged into arbitrary kernel memory disclosure.\nI:H - The attacker grooms the freed hci_conn_params slot with controlled data, so freed memory dictates which connection is looked up and what parameters are programmed into the controller; a use-after-free of this kind is a standard primitive for heap manipulation and control-flow/data corruption in the kernel.\nA:H - The bug is a confirmed KASAN slab-use-after-free (BUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0) in a workqueue context, which panics on KASAN/panic_on_warn kernels and readily causes oopses or unpredictable Bluetooth-stack state otherwise."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"],"versions":[{"version":"0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc","lessThan":"65ce6fe1b92112ba9064ded932c03180da3dd230","status":"affected","versionType":"git"},{"version":"0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc","lessThan":"57059ff14d81df4a970b2ea8d8f54431bb91a025","status":"affected","versionType":"git"},{"version":"0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc","lessThan":"b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa","status":"affected","versionType":"git"},{"version":"0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc","lessThan":"2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/65ce6fe1b92112ba9064ded932c03180da3dd230"},{"url":"https://git.kernel.org/stable/c/57059ff14d81df4a970b2ea8d8f54431bb91a025"},{"url":"https://git.kernel.org/stable/c/b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa"},{"url":"https://git.kernel.org/stable/c/2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e"}],"title":"Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update","x_generator":{"engine":"bippy-1.2.0"}}}}