In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

Dereferencing RCU-protected pointers outside critical sections is
invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also
needs to hold refcount to avoid UAF.

Take appropriate locks for hci_conn lookups, and take refcount for
hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays
valid.

When accessing conn->state, ensure hdev->lock is held to avoid data
race.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
7b445e220db9a2c58be5d09bbbd322abf1b1452a affected < b56f2ecafc08f372bf0529f9c4f3f429cb1702dc
7b445e220db9a2c58be5d09bbbd322abf1b1452a affected < f915e74b6f18293d1d69a2a3305ef321ff7c0172
7b445e220db9a2c58be5d09bbbd322abf1b1452a affected < d5b3b484b62bb0f4542e7622789d28871626cdf0
7b445e220db9a2c58be5d09bbbd322abf1b1452a affected < ecdcb55ea1c01dda074406f38058785a69526734
7b445e220db9a2c58be5d09bbbd322abf1b1452a affected < da55f570191d5d72f10c607a7043b947eb05ea46
Linux Linux affected
Version Status Constraints
6.0 affected —
0 unaffected < 6.0
6.6.148 unaffected ≤ 6.6.*
6.12.101 unaffected ≤ 6.12.*
6.18.42 unaffected ≤ 6.18.*
7.1.6 unaffected ≤ 7.1.*
7.2-rc4 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/b56f2ecafc08f372bf0529f9c4f3f429cb1702dc cve-icon
https://git.kernel.org/stable/c/d5b3b484b62bb0f4542e7622789d28871626cdf0 cve-icon
https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46 cve-icon
https://git.kernel.org/stable/c/ecdcb55ea1c01dda074406f38058785a69526734 cve-icon
https://git.kernel.org/stable/c/f915e74b6f18293d1d69a2a3305ef321ff7c0172 cve-icon
History

Mon, 10 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.
Title Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T12:04:10.564Z

Reserved: 2026-07-30T09:28:09.388Z

Link: CVE-2026-68391

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T16:15:04Z

Weaknesses