CVE-2026-68393 is a vulnerability in Linux Kernel
Published on August 10, 2026
Bluetooth: hci_sync: extend conn_hash lookup critical sections
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: extend conn_hash lookup critical sections
Using RCU-protected pointers outside the critical sections without
refcount is incorrect and may result to UAF.
Extend critical section to cover both hci_conn_hash lookup and use of
the returned conn.
Add surrounding rcu_read_lock() also when return value is not used, in
preparation for RCU lockdep requirement to hci_lookup_le_connect().
This avoids concurrent deletion of the conn before we are done
dereferencing it.
Also, make sure to hold hdev->lock when accessing hdev->accept_list.
Products Associated with CVE-2026-68393
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 6d0417e4e1cf66fd917f06f0454958362714ef7d and below 83b7e67698d0b93f685875ce82c8d335436834f7 is affected.
- Version 6d0417e4e1cf66fd917f06f0454958362714ef7d and below 38326774df6198df0cc2744cc73bf77cb741c538 is affected.
- Version 6d0417e4e1cf66fd917f06f0454958362714ef7d and below d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d is affected.
- Version eb8b860e87b296bd1874c79a668081efd00f9754 is affected.
- Version 94bf6380e936339a700c0b3171a49baf512aa70b is affected.
- Version 6.12.28 and below 6.13 is affected.
- Version 6.14.6 and below 6.15 is affected.
- Version 6.15 is affected.
- Before 6.15 is unaffected.
- Version 6.18.42, <= 6.18.* is unaffected.
- Version 7.1.6, <= 7.1.* is unaffected.
- Version 7.2-rc4, <= * is unaffected.