CVE-2026-68394 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
MGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hci_conn_params entry from hdev->le_conn_params. A later LOAD_CONN_PARAM request can clear disabled parameters and free that entry before hci_cmd_sync_work() runs the queued callback.
Do not keep the borrowed hci_conn_params pointer in queued work. Queue the hci_conn instead and hold a reference until the queued callback completes. When the work runs, revalidate that the connection is still present, look up the current hci_conn_params entry, and cancel the update if userspace removed that entry while the work was pending.
Copy the interval values from the current params entry under hdev->lock, then drop the lock and keep using hci_le_conn_update_sync() to issue the update.
Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth]
Read of size 1 at addr ffff88810c697126 by task kworker/u17:0/377 Workqueue: hci0 hci_cmd_sync_work [bluetooth]
Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x5f0 kasan_report+0xe0/0x110 conn_update_sync+0x2a/0xf0 [bluetooth]
hci_cmd_sync_work+0x187/0x210 [bluetooth]
process_one_work+0x4fd/0xbc0 worker_thread+0x2d8/0x570 kthread+0x1ad/0x1f0 ret_from_fork+0x3c9/0x540 ret_from_fork_asm+0x1a/0x30
Allocated by task 466: hci_conn_params_add+0xa6/0x240 [bluetooth]
load_conn_param+0x4e1/0x850 [bluetooth]
hci_sock_sendmsg+0x96b/0xf80 [bluetooth]
Freed by task 474: kfree+0x313/0x590 hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth]
load_conn_param+0x4bf/0x850 [bluetooth]
hci_sock_sendmsg+0x96b/0xf80 [bluetooth]
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability resides within the Linux kernel's Bluetooth subsystem, specifically affecting the MGMT interface and connection parameter handling for LE central connections. The issue stems from improper management of memory references during asynchronous parameter updates, creating a use-after-free condition that can lead to system instability or potential exploitation. The flaw manifests when the MGMT_OP_LOAD_CONN_PARAM operation queues a conn_update_sync() callback to update connection parameters but fails to properly manage the lifecycle of borrowed hci_conn_params entries.
The technical root cause involves the queued work maintaining a reference to an hci_conn_params entry that may be freed by subsequent LOAD_CONN_PARAM requests before the queued callback executes. This creates a dangling pointer scenario where conn_update_sync() attempts to access memory that has already been deallocated, as evidenced by the KASAN slab-use-after-free error. The kernel's workqueue mechanism processes the queued callback through hci_cmd_sync_work, which then calls conn_update_sync, triggering the invalid memory access at address ffff88810c697126.
The operational impact of this vulnerability extends beyond simple system crashes to potential security implications within the Bluetooth subsystem. Attackers could potentially exploit this condition to cause denial of service or, in more sophisticated scenarios, achieve privilege escalation through controlled memory corruption. The vulnerability affects systems running Linux kernels with Bluetooth support where LE central connections are actively managed and parameter updates are frequently requested.
Mitigation strategies must address the fundamental reference management issue by ensuring proper connection lifecycle handling during asynchronous operations. The fix requires queuing the hci_conn structure instead of the borrowed hci_conn_params pointer, maintaining a reference until callback completion while revalidating connection presence at execution time. This approach aligns with CWE-415: Double Free and CWE-416: Use After Free principles, ensuring proper memory management during concurrent operations.
The solution involves implementing proper synchronization mechanisms under hdev->lock to copy interval values before releasing the lock, then proceeding with the actual connection update operation using hci_le_conn_update_sync(). This approach prevents race conditions while maintaining system stability and security. The fix addresses ATT&CK technique T1059 by preventing malicious code execution through kernel memory corruption, and T1489 by mitigating potential denial of service attacks targeting the Bluetooth subsystem.
This vulnerability demonstrates the complexity of managing shared resources in kernel space where multiple threads and asynchronous operations must coordinate safely without introducing race conditions or memory corruption issues. The fix requires careful attention to reference counting, synchronization primitives, and proper error handling within the Bluetooth subsystem's connection management code.