GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68390 (GCVE-0-2026-68390)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:04
VLAI
Title
Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups hci_conn_params_lookup requires hdev->lock be held, otherwise the list iteration or param access is not safe. Hold hdev->lock for params lookups in hci_sync.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c530569adc19b5f0c62955de41f067bad34e3fe0 , < 8d892bec1dd134761cabec6ba23fe315d0f20f98 (git)
Affected: c530569adc19b5f0c62955de41f067bad34e3fe0 , < c363202ec841df36421ec280eea3d5f94f556143 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8d892bec1dd134761cabec6ba23fe315d0f20f98",
              "status": "affected",
              "version": "c530569adc19b5f0c62955de41f067bad34e3fe0",
              "versionType": "git"
            },
            {
              "lessThan": "c363202ec841df36421ec280eea3d5f94f556143",
              "status": "affected",
              "version": "c530569adc19b5f0c62955de41f067bad34e3fe0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hold hdev-\u003elock for hci_conn_params lookups\n\nhci_conn_params_lookup requires hdev-\u003elock be held, otherwise the list\niteration or param access is not safe.\n\nHold hdev-\u003elock for params lookups in hci_sync."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable hci_sync paths are Bluetooth LE host-stack code: hci_le_create_conn_sync is queued autonomously from check_pending_le_conn() on incoming LE advertising reports, and the racing hci_conn_params_del() side is driven by LE connection-complete/failure and disconnect events, so a device in radio range drives the bug over the air.\nAC:L - The attacker controls both sides of the race \u2014 repeated LE connect/disconnect and PA-sync setup/teardown cycles queue the cmd_sync work while the event workqueue concurrently runs hci_conn_params_del()/hci_conn_del() under hdev-\u003elock \u2014 and the sleeping hci_pause_advertising_sync() right before the unlocked lookup widens the window, so it can be retried until won.\nPR:N - No credentials, pairing, or local account are needed: the host stack queues hci_le_create_conn_sync automatically in response to advertising reports from a device on the accept list, and the freeing side is triggered by connection-complete/failure events the peer controls.\nUI:N - Background LE scanning, auto-connect, accept-list programming, and connection-failure cleanup are performed autonomously by the kernel whenever connection state changes; no victim action such as pairing confirmation or opening a device is required.\nS:U - The corruption is confined to kernel heap objects owned by the Bluetooth subsystem within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - hci_conn_params_lookup() iterates and dereferences a list entry that another CPU may have list_del()\u0027d and kfree()\u0027d, and hci_le_pa_create_sync() reads le-\u003edst/le-\u003ehandle from a possibly freed hci_conn; a groomed slab yields an arbitrary read primitive, and the stale values are copied into the outgoing HCI command, leaking kernel heap contents over the air.\nI:H - This is a classic slab use-after-free on hci_conn_params/hci_conn: reclaiming the freed object with attacker-controlled data gives write and control-flow primitives, and the corrupted values are written into conn-\u003ele_conn_* fields and the HCI command payload, so kernel memory corruption and privilege escalation are leverageable.\nA:H - Walking le_conn_params without hdev-\u003elock while an entry is removed dereferences LIST_POISON1 or freed memory, producing slab-use-after-free KASAN splats, oopses, or a kernel panic in the Bluetooth workqueues."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:37.940Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8d892bec1dd134761cabec6ba23fe315d0f20f98"
        },
        {
          "url": "https://git.kernel.org/stable/c/c363202ec841df36421ec280eea3d5f94f556143"
        }
      ],
      "title": "Bluetooth: hci_sync: hold hdev-\u003elock for hci_conn_params lookups",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68390",
    "datePublished": "2026-08-10T12:04:09.373Z",
    "dateReserved": "2026-07-30T09:28:09.388Z",
    "dateUpdated": "2026-08-17T05:04:37.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68390",
      "date": "2026-09-16",
      "epss": "0.00218",
      "percentile": "0.12443"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68390\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:32.323\",\"lastModified\":\"2026-08-17T06:17:47.643\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: hci_sync: hold hdev-\u003elock for hci_conn_params lookups\\n\\nhci_conn_params_lookup requires hdev-\u003elock be held, otherwise the list\\niteration or param access is not safe.\\n\\nHold hdev-\u003elock for params lookups in hci_sync.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c530569adc19b5f0c62955de41f067bad34e3fe0\",\"lessThan\":\"8d892bec1dd134761cabec6ba23fe315d0f20f98\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c530569adc19b5f0c62955de41f067bad34e3fe0\",\"lessThan\":\"c363202ec841df36421ec280eea3d5f94f556143\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/hci_sync.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8d892bec1dd134761cabec6ba23fe315d0f20f98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c363202ec841df36421ec280eea3d5f94f556143\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:27:11+00:00",
      "cve": "CVE-2026-68390",
      "id": "CVE-2026-68390",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: hci_sync: hold hdev-\u003elock for hci_conn_params lookups",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68390.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-13T16:22:40Z",
      "cve": "CVE-2026-68390",
      "id": "CVE-2026-68390",
      "initial_release_date": "2026-08-13T16:22:40Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68390",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68390.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.