Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-68392

Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev->lock for hci_conn lookup and hci_abort_conn(). Don't use RCU to ensure the conn is fully initialized at this point.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 7fe4d391e937c2f048a43ff4b421e677f10d83c0 to < 74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82affected
  • 249c88e7fb45b6b705040c5af4bd0d0f2bc9735c to < 8bc83f9ef6789571f399ff631a2a14a12b6d8585affected
  • 227a0cdf4a028a73dc256d0f5144b4808d718893 to < 579faba5ede6df6b7f36777c431dc8dcf9d272e7affected
  • 227a0cdf4a028a73dc256d0f5144b4808d718893 to < ca58ad287bfc5b9d31a72ecb8650289df2b57250affected
  • 227a0cdf4a028a73dc256d0f5144b4808d718893 to < b11511006f9e17000de3f4cadee451364f658ca3affected
  • 227a0cdf4a028a73dc256d0f5144b4808d718893 to < 16cd66443957e4ad42155c6fec401012f600c6f8affected
  • 58afdc9b18871eb1d461c725be9e9f3f44a39aebaffected
  • 6.6.51 to < 6.6.148affected
  • 6.10.10 to < 6.11affected

Linux Linux

Default version status: affected

  • 6.11affected
  • 0 to < 6.11unaffected
  • 6.6.148 to ≤ 6.6.*unaffected
  • 6.12.101 to ≤ 6.12.*unaffected
  • 6.18.42 to ≤ 6.18.*unaffected
  • 7.1.6 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References