{"id":"CVE-2026-68392","state":"PUBLISHED","title":"Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix locking in unpair_device/disconnect_sync\n\nDereferencing RCU-protected pointers outside critical sections is\ninvalid and may lead to UAF.\n\nTake hdev->lock for hci_conn lookup and hci_abort_conn().  Don't use RCU\nto ensure the conn is fully initialized at this point.","publishedAt":"2026-08-10T12:04:11.543Z","updatedAt":"2026-08-23T12:46:21.017Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7fe4d391e937c2f048a43ff4b421e677f10d83c0","status":"affected","lessThan":"74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82","versionType":"git"},{"version":"249c88e7fb45b6b705040c5af4bd0d0f2bc9735c","status":"affected","lessThan":"8bc83f9ef6789571f399ff631a2a14a12b6d8585","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","status":"affected","lessThan":"579faba5ede6df6b7f36777c431dc8dcf9d272e7","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","status":"affected","lessThan":"ca58ad287bfc5b9d31a72ecb8650289df2b57250","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","status":"affected","lessThan":"b11511006f9e17000de3f4cadee451364f658ca3","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","status":"affected","lessThan":"16cd66443957e4ad42155c6fec401012f600c6f8","versionType":"git"},{"version":"58afdc9b18871eb1d461c725be9e9f3f44a39aeb","status":"affected","versionType":"git"},{"version":"6.6.51","status":"affected","lessThan":"6.6.148","versionType":"semver"},{"version":"6.10.10","status":"affected","lessThan":"6.11","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"]}],"references":["https://git.kernel.org/stable/c/74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82","https://git.kernel.org/stable/c/8bc83f9ef6789571f399ff631a2a14a12b6d8585","https://git.kernel.org/stable/c/579faba5ede6df6b7f36777c431dc8dcf9d272e7","https://git.kernel.org/stable/c/ca58ad287bfc5b9d31a72ecb8650289df2b57250","https://git.kernel.org/stable/c/b11511006f9e17000de3f4cadee451364f658ca3","https://git.kernel.org/stable/c/16cd66443957e4ad42155c6fec401012f600c6f8"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68392.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68392","state":"PUBLISHED","datePublished":"2026-08-10T12:04:11.543Z","dateUpdated":"2026-08-23T12:46:21.017Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.388Z"},"containers":{"cna":{"title":"Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix locking in unpair_device/disconnect_sync\n\nDereferencing RCU-protected pointers outside critical sections is\ninvalid and may lead to UAF.\n\nTake hdev->lock for hci_conn lookup and hci_abort_conn().  Don't use RCU\nto ensure the conn is fully initialized at this point."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7fe4d391e937c2f048a43ff4b421e677f10d83c0","status":"affected","lessThan":"74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82","versionType":"git"},{"version":"249c88e7fb45b6b705040c5af4bd0d0f2bc9735c","status":"affected","lessThan":"8bc83f9ef6789571f399ff631a2a14a12b6d8585","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","status":"affected","lessThan":"579faba5ede6df6b7f36777c431dc8dcf9d272e7","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","status":"affected","lessThan":"ca58ad287bfc5b9d31a72ecb8650289df2b57250","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","status":"affected","lessThan":"b11511006f9e17000de3f4cadee451364f658ca3","versionType":"git"},{"version":"227a0cdf4a028a73dc256d0f5144b4808d718893","status":"affected","lessThan":"16cd66443957e4ad42155c6fec401012f600c6f8","versionType":"git"},{"version":"58afdc9b18871eb1d461c725be9e9f3f44a39aeb","status":"affected","versionType":"git"},{"version":"6.6.51","status":"affected","lessThan":"6.6.148","versionType":"semver"},{"version":"6.10.10","status":"affected","lessThan":"6.11","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.11","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/mgmt.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82"},{"url":"https://git.kernel.org/stable/c/8bc83f9ef6789571f399ff631a2a14a12b6d8585"},{"url":"https://git.kernel.org/stable/c/579faba5ede6df6b7f36777c431dc8dcf9d272e7"},{"url":"https://git.kernel.org/stable/c/ca58ad287bfc5b9d31a72ecb8650289df2b57250"},{"url":"https://git.kernel.org/stable/c/b11511006f9e17000de3f4cadee451364f658ca3"},{"url":"https://git.kernel.org/stable/c/16cd66443957e4ad42155c6fec401012f600c6f8"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is entered by a local process sending MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR_DEVICE on an AF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL, and the freeing side is drivable locally via /dev/vhci events or ioctl(HCIDEVDOWN)/hci_conn_hash_flush; no over-the-air access is required.\nAC:L - The attacker controls both sides of the race — repeatedly queuing the mgmt command while tearing the connection down (vhci-injected disconnect-complete, HCIDEVDOWN, or connection timeout) — and can retry indefinitely, so the window is reached reliably.\nPR:L - The mgmt command needs a trusted control socket, but that capability is routinely held by the Bluetooth daemon and exposed to unprivileged session users through BlueZ Disconnect/RemoveDevice D-Bus methods, so an ordinary local user can drive the path with attacker-chosen addresses.\nUI:N - Both the mgmt command and the concurrent connection teardown are initiated programmatically by the attacker; no victim action such as pairing confirmation or opening a file is needed.\nS:U - The corruption is confined to kernel heap objects managed by the Bluetooth subsystem within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - hci_abort_conn() dereferences the freed hci_conn (conn->hdev, conn->abort_reason, conn->handle) after it has been unlinked and released, so an attacker who reclaims the slab with controlled data obtains a read primitive over kernel memory and can leak pointers.\nI:H - The use-after-free is not read-only: hci_abort_conn() stores the attacker-reachable reason byte into conn->abort_reason and hci_conn_get() increments a refcount inside the freed object, giving a write primitive into reclaimed heap memory that is leverageable for control-flow hijack.\nA:H - Dereferencing a freed or partially initialized hci_conn and then queuing abort_conn_sync on it produces slab-use-after-free oopses, refcount underflow, and kernel panics, crashing the system."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:46:21.017Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.51","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}