{"api_version":"1","generated_at":"2026-08-13T11:48:28+00:00","cve":"CVE-2026-68189","urls":{"html":"https://cve.report/CVE-2026-68189","api":"https://cve.report/api/cve/CVE-2026-68189.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68189","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68189"},"summary":{"title":"Bluetooth: hci_sync: Protect UUID list traversal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Protect UUID list traversal\n\nThe hci_sync conversion moved class-of-device and EIR generation from an\nHCI request built under hdev->lock to asynchronous command sync work.\nThe worker holds hdev->req_lock, but that lock does not serialize access\nto hdev->uuids against add_uuid() and remove_uuid(), which update the\nlist under hdev->lock.\n\nThe following interleaving can therefore occur:\n\n  CPU0 (command sync work)       CPU1 (management socket)\n  fetch uuid from the list\n                                list_del(&uuid->list)\n                                kfree(uuid)\n  read uuid->size\n\nKASAN reports the resulting use-after-free:\n\n  BUG: KASAN: slab-use-after-free in eir_create+0xb8f/0xee0\n  Read of size 1 at addr ffff88810dbd8620 by task kworker/u17:0/87\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   eir_create+0xb8f/0xee0\n   hci_update_eir_sync+0x1c0/0x330\n   hci_cmd_sync_work+0x13c/0x290\n   process_one_work+0x63a/0x1070\n   worker_thread+0x45b/0xd10\n\n  Allocated by task 86:\n   __kasan_kmalloc+0x8f/0xa0\n   add_uuid+0x18a/0x4b0\n   hci_sock_sendmsg+0x1033/0x1ea0\n\n  Freed by task 92:\n   __kasan_slab_free+0x43/0x70\n   kfree+0x131/0x3c0\n   remove_uuid+0x25e/0x560\n   hci_sock_sendmsg+0x1033/0x1ea0\n\nHold hdev->lock while generating and committing the class-of-device and\nEIR snapshots.  Release it before sending an HCI command, so controller\nwaits do not happen under the device lock.  This protects all UUID list\nwalks in these paths and restores the serialization lost in the command\nsync conversion.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:06","updated_at":"2026-08-10 13:20:06"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/fe13adc258df88d95789e5673c7ba5178b5f8b28","name":"https://git.kernel.org/stable/c/fe13adc258df88d95789e5673c7ba5178b5f8b28","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a42f5536ea9c00e13f0c0fbb330feed95e2365ca","name":"https://git.kernel.org/stable/c/a42f5536ea9c00e13f0c0fbb330feed95e2365ca","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a351f68fb24828b23a971e00b8238ee0e8a40380","name":"https://git.kernel.org/stable/c/a351f68fb24828b23a971e00b8238ee0e8a40380","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e9027ffbf5a0f3c12ca8900822e884eae9f0821b","name":"https://git.kernel.org/stable/c/e9027ffbf5a0f3c12ca8900822e884eae9f0821b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e4fa2c5c261d736b8e58759fdef3a968d510630c","name":"https://git.kernel.org/stable/c/e4fa2c5c261d736b8e58759fdef3a968d510630c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68189","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68189","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 161510ccf91c961638940b03abb1ee804be53a97 e4fa2c5c261d736b8e58759fdef3a968d510630c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 161510ccf91c961638940b03abb1ee804be53a97 a351f68fb24828b23a971e00b8238ee0e8a40380 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 161510ccf91c961638940b03abb1ee804be53a97 a42f5536ea9c00e13f0c0fbb330feed95e2365ca git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 161510ccf91c961638940b03abb1ee804be53a97 fe13adc258df88d95789e5673c7ba5178b5f8b28 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 161510ccf91c961638940b03abb1ee804be53a97 e9027ffbf5a0f3c12ca8900822e884eae9f0821b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc5 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e4fa2c5c261d736b8e58759fdef3a968d510630c","status":"affected","version":"161510ccf91c961638940b03abb1ee804be53a97","versionType":"git"},{"lessThan":"a351f68fb24828b23a971e00b8238ee0e8a40380","status":"affected","version":"161510ccf91c961638940b03abb1ee804be53a97","versionType":"git"},{"lessThan":"a42f5536ea9c00e13f0c0fbb330feed95e2365ca","status":"affected","version":"161510ccf91c961638940b03abb1ee804be53a97","versionType":"git"},{"lessThan":"fe13adc258df88d95789e5673c7ba5178b5f8b28","status":"affected","version":"161510ccf91c961638940b03abb1ee804be53a97","versionType":"git"},{"lessThan":"e9027ffbf5a0f3c12ca8900822e884eae9f0821b","status":"affected","version":"161510ccf91c961638940b03abb1ee804be53a97","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc5","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc5","versionStartIncluding":"5.17","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Protect UUID list traversal\n\nThe hci_sync conversion moved class-of-device and EIR generation from an\nHCI request built under hdev->lock to asynchronous command sync work.\nThe worker holds hdev->req_lock, but that lock does not serialize access\nto hdev->uuids against add_uuid() and remove_uuid(), which update the\nlist under hdev->lock.\n\nThe following interleaving can therefore occur:\n\n  CPU0 (command sync work)       CPU1 (management socket)\n  fetch uuid from the list\n                                list_del(&uuid->list)\n                                kfree(uuid)\n  read uuid->size\n\nKASAN reports the resulting use-after-free:\n\n  BUG: KASAN: slab-use-after-free in eir_create+0xb8f/0xee0\n  Read of size 1 at addr ffff88810dbd8620 by task kworker/u17:0/87\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   eir_create+0xb8f/0xee0\n   hci_update_eir_sync+0x1c0/0x330\n   hci_cmd_sync_work+0x13c/0x290\n   process_one_work+0x63a/0x1070\n   worker_thread+0x45b/0xd10\n\n  Allocated by task 86:\n   __kasan_kmalloc+0x8f/0xa0\n   add_uuid+0x18a/0x4b0\n   hci_sock_sendmsg+0x1033/0x1ea0\n\n  Freed by task 92:\n   __kasan_slab_free+0x43/0x70\n   kfree+0x131/0x3c0\n   remove_uuid+0x25e/0x560\n   hci_sock_sendmsg+0x1033/0x1ea0\n\nHold hdev->lock while generating and committing the class-of-device and\nEIR snapshots.  Release it before sending an HCI command, so controller\nwaits do not happen under the device lock.  This protects all UUID list\nwalks in these paths and restores the serialization lost in the command\nsync conversion."}],"providerMetadata":{"dateUpdated":"2026-08-10T12:00:01.711Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e4fa2c5c261d736b8e58759fdef3a968d510630c"},{"url":"https://git.kernel.org/stable/c/a351f68fb24828b23a971e00b8238ee0e8a40380"},{"url":"https://git.kernel.org/stable/c/a42f5536ea9c00e13f0c0fbb330feed95e2365ca"},{"url":"https://git.kernel.org/stable/c/fe13adc258df88d95789e5673c7ba5178b5f8b28"},{"url":"https://git.kernel.org/stable/c/e9027ffbf5a0f3c12ca8900822e884eae9f0821b"}],"title":"Bluetooth: hci_sync: Protect UUID list traversal","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68189","datePublished":"2026-08-10T12:00:01.711Z","dateReserved":"2026-07-30T09:28:09.373Z","dateUpdated":"2026-08-10T12:00:01.711Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:06","lastModifiedDate":"2026-08-10 13:20:06","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68189","Ordinal":"1","Title":"Bluetooth: hci_sync: Protect UUID list traversal","CVE":"CVE-2026-68189","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68189","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Protect UUID list traversal\n\nThe hci_sync conversion moved class-of-device and EIR generation from an\nHCI request built under hdev->lock to asynchronous command sync work.\nThe worker holds hdev->req_lock, but that lock does not serialize access\nto hdev->uuids against add_uuid() and remove_uuid(), which update the\nlist under hdev->lock.\n\nThe following interleaving can therefore occur:\n\n  CPU0 (command sync work)       CPU1 (management socket)\n  fetch uuid from the list\n                                list_del(&uuid->list)\n                                kfree(uuid)\n  read uuid->size\n\nKASAN reports the resulting use-after-free:\n\n  BUG: KASAN: slab-use-after-free in eir_create+0xb8f/0xee0\n  Read of size 1 at addr ffff88810dbd8620 by task kworker/u17:0/87\n  Workqueue: hci0 hci_cmd_sync_work\n  Call Trace:\n   eir_create+0xb8f/0xee0\n   hci_update_eir_sync+0x1c0/0x330\n   hci_cmd_sync_work+0x13c/0x290\n   process_one_work+0x63a/0x1070\n   worker_thread+0x45b/0xd10\n\n  Allocated by task 86:\n   __kasan_kmalloc+0x8f/0xa0\n   add_uuid+0x18a/0x4b0\n   hci_sock_sendmsg+0x1033/0x1ea0\n\n  Freed by task 92:\n   __kasan_slab_free+0x43/0x70\n   kfree+0x131/0x3c0\n   remove_uuid+0x25e/0x560\n   hci_sock_sendmsg+0x1033/0x1ea0\n\nHold hdev->lock while generating and committing the class-of-device and\nEIR snapshots.  Release it before sending an HCI command, so controller\nwaits do not happen under the device lock.  This protects all UUID list\nwalks in these paths and restores the serialization lost in the command\nsync conversion.","Type":"Description","Title":"Bluetooth: hci_sync: Protect UUID list traversal"}]}}}