CVE-2026-68189: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68189 Overview

CVE-2026-68189 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_sync code path. The flaw stems from unsynchronized access to the hdev->uuids list during Extended Inquiry Response (EIR) generation. A local attacker with the ability to send management socket commands can race add_uuid() and remove_uuid() operations against hci_cmd_sync_work to trigger a slab use-after-free. KASAN reports the read of freed memory inside eir_create(). Successful exploitation may lead to kernel memory corruption, information disclosure, denial of service, or local privilege escalation.

Critical Impact
A local attacker can trigger a race condition against the Bluetooth command sync worker to cause a use-after-free in kernel memory, potentially leading to privilege escalation or kernel crash.

Affected Products

Linux kernel — Bluetooth subsystem (net/bluetooth/hci_sync.c, mgmt.c)
Kernel branches containing the hci_sync conversion of class-of-device and EIR generation
Fixed via commits a351f68fb248, a42f5536ea9c, e4fa2c5c261d, e9027ffbf5a0, fe13adc258df

Discovery Timeline

2026-08-10 - CVE-2026-68189 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68189

Vulnerability Analysis

The Linux kernel's Bluetooth Host Controller Interface (HCI) uses two distinct locks: hdev->lock protects device state including the hdev->uuids list, while hdev->req_lock serializes HCI request execution. The hci_sync refactor moved class-of-device and EIR frame generation out of an HCI request built under hdev->lock into asynchronous command sync work executed by hci_cmd_sync_work.

That worker only holds hdev->req_lock. It does not hold hdev->lock, so it cannot safely traverse hdev->uuids. Meanwhile, add_uuid() and remove_uuid(), invoked through the management socket via hci_sock_sendmsg(), mutate the list under hdev->lock. The two paths execute concurrently on separate CPUs without shared synchronization.

Root Cause

The root cause is a race condition ([CWE-362]) combined with a use-after-free ([CWE-416]). While eir_create() traverses hdev->uuids and dereferences a UUID entry, another task can call remove_uuid(), execute list_del(&uuid->list), and kfree(uuid). The subsequent read of uuid->size inside eir_create() reads freed slab memory, as captured by the KASAN report slab-use-after-free in eir_create+0xb8f/0xee0.

Attack Vector

Exploitation requires local access and the ability to open a Bluetooth management socket, which typically requires CAP_NET_ADMIN or membership in a privileged group. An attacker repeatedly invokes the management commands that call add_uuid and remove_uuid while triggering EIR updates that schedule hci_cmd_sync_work. Winning the race yields a controlled use-after-free on a slab object, which can be shaped into kernel memory disclosure or write primitives.

No verified public exploit code is available. See the upstream fix commits for technical details on the corrected locking discipline.

Detection Methods for CVE-2026-68189

Indicators of Compromise

KASAN reports referencing slab-use-after-free in eir_create or call traces including hci_update_eir_sync and hci_cmd_sync_work.
Unexpected kernel oops or panic entries in dmesg tied to the Bluetooth workqueue hci0.
Unprivileged or unexpected processes opening HCI management sockets and issuing rapid MGMT_OP_ADD_UUID / MGMT_OP_REMOVE_UUID sequences.

Detection Strategies

Enable KASAN on test and canary kernels to catch use-after-free reads in eir_create() during fuzzing or normal operation.
Audit auditd execve and syscall telemetry for processes invoking Bluetooth management ioctls outside of expected system services like bluetoothd.
Correlate kernel crash telemetry with Bluetooth workqueue stack frames to distinguish this bug from unrelated Bluetooth faults.

Monitoring Recommendations

Ship kernel logs to a centralized log platform and alert on KASAN, BUG:, and hci_cmd_sync_work co-occurrences.
Track kernel version inventory across the fleet to identify hosts running vulnerable branches without the fix commits applied.
Monitor for anomalous Bluetooth stack activity on servers and workstations where Bluetooth is not a business requirement.

How to Mitigate CVE-2026-68189

Immediate Actions Required

Apply the upstream stable kernel updates that include commits a351f68fb248, a42f5536ea9c, e4fa2c5c261d, e9027ffbf5a0, and fe13adc258df.
Restrict CAP_NET_ADMIN and access to Bluetooth management sockets to trusted system services only.
On systems that do not require Bluetooth, blacklist the bluetooth and btusb kernel modules to remove the attack surface entirely.

Patch Information

The fix holds hdev->lock while generating and committing the class-of-device and EIR snapshots, then releases the lock before issuing the HCI command so controller waits do not occur under the device lock. This restores the serialization that was lost during the hci_sync conversion and protects all UUID list walks in these paths. Refer to the Kernel Git Commit a351f68fb248 and the additional stable backports listed under references.

Workarounds

Disable the Bluetooth stack on hosts that do not require it using systemctl disable --now bluetooth and blacklisting the bluetooth module.
Reduce exposure by ensuring only bluetoothd and equivalent trusted daemons hold CAP_NET_ADMIN on production systems.
Use SELinux or AppArmor policies to confine which processes can open AF_BLUETOOTH sockets.

bash

# Configuration example: disable Bluetooth on systems that do not need it
sudo systemctl disable --now bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo update-initramfs -u