CVE-2026-68189 - Vulnerability Details

- Bluetooth: hci_sync: Protect UUID list traversal

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Protect UUID list traversal

The hci_sync conversion moved class-of-device and EIR generation from an
HCI request built under hdev->lock to asynchronous command sync work.
The worker holds hdev->req_lock, but that lock does not serialize access
to hdev->uuids against add_uuid() and remove_uuid(), which update the
list under hdev->lock.

The following interleaving can therefore occur:

CPU0 (command sync work) CPU1 (management socket)
fetch uuid from the list
list_del(&uuid->list)
kfree(uuid)
read uuid->size

KASAN reports the resulting use-after-free:

BUG: KASAN: slab-use-after-free in eir_create+0xb8f/0xee0
Read of size 1 at addr ffff88810dbd8620 by task kworker/u17:0/87
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
eir_create+0xb8f/0xee0
hci_update_eir_sync+0x1c0/0x330
hci_cmd_sync_work+0x13c/0x290
process_one_work+0x63a/0x1070
worker_thread+0x45b/0xd10

Allocated by task 86:
__kasan_kmalloc+0x8f/0xa0
add_uuid+0x18a/0x4b0
hci_sock_sendmsg+0x1033/0x1ea0

Freed by task 92:
__kasan_slab_free+0x43/0x70
kfree+0x131/0x3c0
remove_uuid+0x25e/0x560
hci_sock_sendmsg+0x1033/0x1ea0

Hold hdev->lock while generating and committing the class-of-device and
EIR snapshots. Release it before sending an HCI command, so controller
waits do not happen under the device lock. This protects all UUID list
walks in these paths and restores the serialization lost in the command
sync conversion.

Published: 2026-08-10

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition exists between a workqueue that processes HCI commands and the management socket that adds or removes UUID entries from a Bluetooth device. While the work queue holds hdev->req_lock, it does not hold hdev->lock, which protects the UUID list. This allows a UUID entry to be freed while another thread reads it during EIR snapshot generation, causing a use‑after‑free that KASAN reports in eir_create. The resulting memory corruption can lead to a kernel crash.

Affected Systems

All Linux kernels that lack the fix for the hci_sync bug, namely releases that do not contain commit a351f68fb or its later merges. The vulnerability is present in the generic Linux kernel source and therefore affects any distribution kernel that has not applied this patch.

Risk and Exploitability

The vulnerability has a high potential impact because it corrupts kernel memory and can cause a system crash. The EPSS score is <1% and the vulnerability is not listed in CISA KEV. The CVSS score is 7.8. The race condition can be triggered when a Bluetooth device is accessed simultaneously via the management socket and during HCI command processing. Because the condition involves local kernel data structures, the attacker would need local access to the affected system to trigger it.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`161510ccf91c961638940b03abb1ee804be53a97`	affected	< 30bc6248f035a792d1b1f4cc761b32fd5827b55f
`161510ccf91c961638940b03abb1ee804be53a97`	affected	< e4fa2c5c261d736b8e58759fdef3a968d510630c
`161510ccf91c961638940b03abb1ee804be53a97`	affected	< a351f68fb24828b23a971e00b8238ee0e8a40380
`161510ccf91c961638940b03abb1ee804be53a97`	affected	< a42f5536ea9c00e13f0c0fbb330feed95e2365ca
`161510ccf91c961638940b03abb1ee804be53a97`	affected	< fe13adc258df88d95789e5673c7ba5178b5f8b28
`161510ccf91c961638940b03abb1ee804be53a97`	affected	< e9027ffbf5a0f3c12ca8900822e884eae9f0821b

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[161510ccf91c961638940b03abb1ee804be53a97,e4fa2c5c261d736b8e58759fdef3a968d510630c)`	affected	code_commit	—
`[161510ccf91c961638940b03abb1ee804be53a97,a351f68fb24828b23a971e00b8238ee0e8a40380)`	affected	code_commit	—
`[161510ccf91c961638940b03abb1ee804be53a97,a42f5536ea9c00e13f0c0fbb330feed95e2365ca)`	affected	code_commit	—
`[161510ccf91c961638940b03abb1ee804be53a97,fe13adc258df88d95789e5673c7ba5178b5f8b28)`	affected	code_commit	—
`[161510ccf91c961638940b03abb1ee804be53a97,e9027ffbf5a0f3c12ca8900822e884eae9f0821b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the hci_sync patch (commit a351f68fb or later).
If a kernel upgrade cannot be applied immediately, disable the Bluetooth service or block incoming Bluetooth traffic with a firewall to prevent attackers from triggering the race condition.
Consider applying the patch manually with a live patching tool such as kpatch if a full reboot is not acceptable, ensuring the fix is applied without downtime.

Generated by OpenCVE AI on August 13, 2026 at 23:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00159.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/30bc6248f035a792d1b1f4cc761b32fd5827b55f
https://git.kernel.org/stable/c/a351f68fb24828b23a971e00b8238ee0e8a40380
https://git.kernel.org/stable/c/a42f5536ea9c00e13f0c0fbb330feed95e2365ca
https://git.kernel.org/stable/c/e4fa2c5c261d736b8e58759fdef3a968d510630c
https://git.kernel.org/stable/c/e9027ffbf5a0f3c12ca8900822e884eae9f0821b
https://git.kernel.org/stable/c/fe13adc258df88d95789e5673c7ba5178b5f8b28
https://lore.kernel.org/linux-cve-announce/2026081009-CVE-2026-68189-19f4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68189
https://www.cve.org/CVERecord?id=CVE-2026-68189

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/30bc6248f035a792d1b1f4cc761b32fd5827b55f

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081009-CVE-2026-68189-19f4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68189 https://www.cve.org/CVERecord?id=CVE-2026-68189
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Protect UUID list traversal The hci_sync conversion moved class-of-device and EIR generation from an HCI request built under hdev->lock to asynchronous command sync work. The worker holds hdev->req_lock, but that lock does not serialize access to hdev->uuids against add_uuid() and remove_uuid(), which update the list under hdev->lock. The following interleaving can therefore occur: CPU0 (command sync work) CPU1 (management socket) fetch uuid from the list list_del(&uuid->list) kfree(uuid) read uuid->size KASAN reports the resulting use-after-free: BUG: KASAN: slab-use-after-free in eir_create+0xb8f/0xee0 Read of size 1 at addr ffff88810dbd8620 by task kworker/u17:0/87 Workqueue: hci0 hci_cmd_sync_work Call Trace: eir_create+0xb8f/0xee0 hci_update_eir_sync+0x1c0/0x330 hci_cmd_sync_work+0x13c/0x290 process_one_work+0x63a/0x1070 worker_thread+0x45b/0xd10 Allocated by task 86: __kasan_kmalloc+0x8f/0xa0 add_uuid+0x18a/0x4b0 hci_sock_sendmsg+0x1033/0x1ea0 Freed by task 92: __kasan_slab_free+0x43/0x70 kfree+0x131/0x3c0 remove_uuid+0x25e/0x560 hci_sock_sendmsg+0x1033/0x1ea0 Hold hdev->lock while generating and committing the class-of-device and EIR snapshots. Release it before sending an HCI command, so controller waits do not happen under the device lock. This protects all UUID list walks in these paths and restores the serialization lost in the command sync conversion.
Title		Bluetooth: hci_sync: Protect UUID list traversal
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/a351f68fb24828b23a971e00b8238ee0e8a40380 https://git.kernel.org/stable/c/a42f5536ea9c00e13f0c0fbb330feed95e2365ca https://git.kernel.org/stable/c/e4fa2c5c261d736b8e58759fdef3a968d510630c https://git.kernel.org/stable/c/e9027ffbf5a0f3c12ca8900822e884eae9f0821b https://git.kernel.org/stable/c/fe13adc258df88d95789e5673c7ba5178b5f8b28

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:00:01.711Z

Updated: 2026-08-19T16:31:01.944Z

Reserved: 2026-07-30T09:28:09.373Z

Link: CVE-2026-68189

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:06.187

Modified: 2026-08-19T17:20:35.153

Link: CVE-2026-68189

Redhat

Severity : Moderate

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68189 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T23:45:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object