{"api_version":"1","generated_at":"2026-08-20T16:32:00+00:00","cve":"CVE-2026-68394","urls":{"html":"https://cve.report/CVE-2026-68394","api":"https://cve.report/api/cve/CVE-2026-68394.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68394","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68394"},"summary":{"title":"Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update\n\nMGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter\nupdate changes an existing LE central connection. The queued work currently\nstores a borrowed hci_conn_params entry from hdev->le_conn_params. A later\nLOAD_CONN_PARAM request can clear disabled parameters and free that entry\nbefore hci_cmd_sync_work() runs the queued callback.\n\nDo not keep the borrowed hci_conn_params pointer in queued work. Queue the\nhci_conn instead and hold a reference until the queued callback completes.\nWhen the work runs, revalidate that the connection is still present, look\nup the current hci_conn_params entry, and cancel the update if userspace\nremoved that entry while the work was pending.\n\nCopy the interval values from the current params entry under hdev->lock,\nthen drop the lock and keep using hci_le_conn_update_sync() to issue the\nupdate.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth]\nRead of size 1 at addr ffff88810c697126 by task kworker/u17:0/377\nWorkqueue: hci0 hci_cmd_sync_work [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n kasan_report+0xe0/0x110\n conn_update_sync+0x2a/0xf0 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30\n\nAllocated by task 466:\n hci_conn_params_add+0xa6/0x240 [bluetooth]\n load_conn_param+0x4e1/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n\nFreed by task 474:\n kfree+0x313/0x590\n hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]\n load_conn_param+0x4bf/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:32","updated_at":"2026-08-17 06:17:48"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/57059ff14d81df4a970b2ea8d8f54431bb91a025","name":"https://git.kernel.org/stable/c/57059ff14d81df4a970b2ea8d8f54431bb91a025","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e","name":"https://git.kernel.org/stable/c/2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/65ce6fe1b92112ba9064ded932c03180da3dd230","name":"https://git.kernel.org/stable/c/65ce6fe1b92112ba9064ded932c03180da3dd230","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa","name":"https://git.kernel.org/stable/c/b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68394","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68394","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc 65ce6fe1b92112ba9064ded932c03180da3dd230 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc 57059ff14d81df4a970b2ea8d8f54431bb91a025 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc 2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68394","cve":"CVE-2026-68394","epss":"0.001250000","percentile":"0.026080000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"65ce6fe1b92112ba9064ded932c03180da3dd230","status":"affected","version":"0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc","versionType":"git"},{"lessThan":"57059ff14d81df4a970b2ea8d8f54431bb91a025","status":"affected","version":"0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc","versionType":"git"},{"lessThan":"b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa","status":"affected","version":"0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc","versionType":"git"},{"lessThan":"2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e","status":"affected","version":"0ece498c27d8cd2fdad6f49a6abc34b8badd8fbc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update\n\nMGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter\nupdate changes an existing LE central connection. The queued work currently\nstores a borrowed hci_conn_params entry from hdev->le_conn_params. A later\nLOAD_CONN_PARAM request can clear disabled parameters and free that entry\nbefore hci_cmd_sync_work() runs the queued callback.\n\nDo not keep the borrowed hci_conn_params pointer in queued work. Queue the\nhci_conn instead and hold a reference until the queued callback completes.\nWhen the work runs, revalidate that the connection is still present, look\nup the current hci_conn_params entry, and cancel the update if userspace\nremoved that entry while the work was pending.\n\nCopy the interval values from the current params entry under hdev->lock,\nthen drop the lock and keep using hci_le_conn_update_sync() to issue the\nupdate.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth]\nRead of size 1 at addr ffff88810c697126 by task kworker/u17:0/377\nWorkqueue: hci0 hci_cmd_sync_work [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n kasan_report+0xe0/0x110\n conn_update_sync+0x2a/0xf0 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30\n\nAllocated by task 466:\n hci_conn_params_add+0xa6/0x240 [bluetooth]\n load_conn_param+0x4e1/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n\nFreed by task 474:\n kfree+0x313/0x590\n hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]\n load_conn_param+0x4bf/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is triggered entirely through local interfaces — two MGMT_OP_LOAD_CONN_PARAM commands written to a local AF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL, reaching load_conn_param() via hci_sock_sendmsg()/hci_mgmt_cmd(). No over-the-air interaction from a remote Bluetooth peer is required.\nAC:L - The attacker controls both sides of the race: it issues the LOAD_CONN_PARAM that queues conn_update_sync() and then immediately issues a second LOAD_CONN_PARAM whose hci_conn_params_clear_disabled() frees the borrowed entry before hci_cmd_sync_work() dequeues it, and it can grool the slab by repeated hci_conn_params_add() calls.\nPR:L - Reaching load_conn_param() needs a trusted MGMT socket (CAP_NET_ADMIN at bind), which is exactly the privilege held by the unprivileged Bluetooth service account on Android and desktop Linux (bluetoothd / com.android.bluetooth) — a low-privilege, externally exposed daemon, not real root, and the standard scoring for MGMT-socket flaws.\nUI:N - Exploitation requires only that the attacker send its own MGMT commands over an existing LE central connection it can itself establish; no action by any other user or victim application is needed.\nS:U - The use-after-free corrupts kernel slab memory and its impact stays within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a slab use-after-free read: conn_update_sync() reads addr/addr_type and the four interval fields from a freed hci_conn_params and places them into the HCI_OP_LE_CONN_UPDATE command, leaking reallocated heap contents; more generally a UAF gives the attacker control over freed-object contents and can be leveraged into arbitrary kernel memory disclosure.\nI:H - The attacker grooms the freed hci_conn_params slot with controlled data, so freed memory dictates which connection is looked up and what parameters are programmed into the controller; a use-after-free of this kind is a standard primitive for heap manipulation and control-flow/data corruption in the kernel.\nA:H - The bug is a confirmed KASAN slab-use-after-free (BUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0) in a workqueue context, which panics on KASAN/panic_on_warn kernels and readily causes oopses or unpredictable Bluetooth-stack state otherwise."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:04:42.328Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/65ce6fe1b92112ba9064ded932c03180da3dd230"},{"url":"https://git.kernel.org/stable/c/57059ff14d81df4a970b2ea8d8f54431bb91a025"},{"url":"https://git.kernel.org/stable/c/b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa"},{"url":"https://git.kernel.org/stable/c/2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e"}],"title":"Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68394","datePublished":"2026-08-10T12:04:13.562Z","dateReserved":"2026-07-30T09:28:09.389Z","dateUpdated":"2026-08-17T05:04:42.328Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:32","lastModifiedDate":"2026-08-17 06:17:48","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68394","Ordinal":"1","Title":"Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update","CVE":"CVE-2026-68394","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68394","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update\n\nMGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter\nupdate changes an existing LE central connection. The queued work currently\nstores a borrowed hci_conn_params entry from hdev->le_conn_params. A later\nLOAD_CONN_PARAM request can clear disabled parameters and free that entry\nbefore hci_cmd_sync_work() runs the queued callback.\n\nDo not keep the borrowed hci_conn_params pointer in queued work. Queue the\nhci_conn instead and hold a reference until the queued callback completes.\nWhen the work runs, revalidate that the connection is still present, look\nup the current hci_conn_params entry, and cancel the update if userspace\nremoved that entry while the work was pending.\n\nCopy the interval values from the current params entry under hdev->lock,\nthen drop the lock and keep using hci_le_conn_update_sync() to issue the\nupdate.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth]\nRead of size 1 at addr ffff88810c697126 by task kworker/u17:0/377\nWorkqueue: hci0 hci_cmd_sync_work [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n kasan_report+0xe0/0x110\n conn_update_sync+0x2a/0xf0 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30\n\nAllocated by task 466:\n hci_conn_params_add+0xa6/0x240 [bluetooth]\n load_conn_param+0x4e1/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n\nFreed by task 474:\n kfree+0x313/0x590\n hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]\n load_conn_param+0x4bf/0x850 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]","Type":"Description","Title":"Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update"}]}}}