CVE-2026-68392

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF.

Take hdev->lock for hci_conn lookup and hci_abort_conn(). Don't use RCU to ensure the conn is fully initialized at this point.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux249c88e7fb45b6b705040c5af4bd0d0f2bc9735c < 8bc83f9ef6789571f399ff631a2a14a12b6d8585affected
LinuxLinux227a0cdf4a028a73dc256d0f5144b4808d718893 < 579faba5ede6df6b7f36777c431dc8dcf9d272e7affected
LinuxLinux227a0cdf4a028a73dc256d0f5144b4808d718893 < ca58ad287bfc5b9d31a72ecb8650289df2b57250affected
LinuxLinux227a0cdf4a028a73dc256d0f5144b4808d718893 < b11511006f9e17000de3f4cadee451364f658ca3affected
LinuxLinux227a0cdf4a028a73dc256d0f5144b4808d718893 < 16cd66443957e4ad42155c6fec401012f600c6f8affected
LinuxLinux58afdc9b18871eb1d461c725be9e9f3f44a39aebaffected
LinuxLinux6.6.51 < 6.6.148affected
LinuxLinux6.10.10 < 6.11affected
LinuxLinux6.11affected
LinuxLinux0 < 6.11unaffected
LinuxLinux6.6.148 <= 6.6.*unaffected
LinuxLinux6.12.101 <= 6.12.*unaffected
LinuxLinux6.18.42 <= 6.18.*unaffected
LinuxLinux7.1.6 <= 7.1.*unaffected
LinuxLinux7.2-rc4 <= *unaffected

Weaknesses

References