CVE-2026-68389: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68389 Overview

CVE-2026-68389 is a use-after-free vulnerability in the Linux kernel Bluetooth stack, specifically in the Qualcomm HCI driver (hci_qca). The flaw resides in qca_controller_memdump(), which fails to clear the saved qca->qca_memdump pointer and collection state when the controller reports an invalid (zero) dump size. A later memdump work item can then operate on freed memory, and stale in-band sleep (IBS) flags can block subsequent transmit handling.

Critical Impact
An attacker within Bluetooth range can trigger the invalid-dump-size path to cause memory corruption, potentially leading to kernel code execution or denial of service on affected Linux hosts.

Affected Products

Linux kernel with the Bluetooth hci_qca driver enabled
Systems using Qualcomm Bluetooth controllers over UART/serdev transport
Distributions shipping vulnerable kernel versions prior to the referenced stable commits

Discovery Timeline

2026-08-10 - CVE-2026-68389 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68389

Vulnerability Analysis

The qca_controller_memdump() function in the Linux kernel hci_qca driver processes controller memory dump packets from a Qualcomm Bluetooth chip. On receipt of the first (sequence-zero) dump packet, the driver allocates a qca_memdump object, stores its pointer in qca->qca_memdump, disables IBS power management, marks memdump collection as active, and reads the advertised dump size from the packet.

When the controller reports a zero dump size, the error path frees the local qca_memdump object and returns. However, it does not clear qca->qca_memdump, nor does it reset the memdump_state or re-enable IBS. A later scheduled memdump work item reads qca->qca_memdump, finds a non-NULL (but dangling) pointer, and skips reallocation, operating directly on freed memory.

Root Cause

The root cause is incomplete error-path cleanup [Use After Free]. The invalid-size branch releases the heap allocation without invalidating the driver-wide reference or reverting the state machine that other code paths depend on. This diverges from the cleanup performed when hci_devcd_init() fails, which properly resets both the pointer and the collection state.

Attack Vector

Exploitation requires adjacent-network access over Bluetooth, meaning an attacker must be within radio range of a target using a vulnerable Qualcomm Bluetooth controller. A malicious or spoofed controller response containing a zero dump size in the first memdump packet triggers the flawed error path. Subsequent memdump work execution then dereferences the freed structure, corrupting kernel memory. No user interaction or authentication is required.

No public exploit or proof-of-concept has been published for this issue at the time of writing. See the Kernel Security Fix Commit for the patched code path.

Detection Methods for CVE-2026-68389

Indicators of Compromise

Kernel oops or panic messages referencing qca_controller_memdump, qca_memdump_timeout, or hci_devcd in dmesg
KASAN reports flagging use-after-free within the hci_qca module
Repeated Bluetooth link resets or hci0 interface hangs following abnormal controller behavior
Unexpected disabling of IBS power management on Qualcomm Bluetooth transports

Detection Strategies

Monitor kernel ring buffer for Bluetooth subsystem faults, particularly stack traces containing qca_controller_memdump or qca_memdump_timeout_work
Enable KASAN on test systems to surface the use-after-free during fuzzing of Bluetooth HCI traffic
Track loaded kernel and module versions across the fleet and correlate against the fixed stable commits listed in the references

Monitoring Recommendations

Aggregate journalctl -k and /var/log/kern.log output centrally and alert on hci_qca fault signatures
Alert on unexpected Bluetooth controller resets or repeated devcoredump generation on production endpoints
Baseline kernel package versions across Linux endpoints and flag hosts running unpatched builds

How to Mitigate CVE-2026-68389

Immediate Actions Required

Apply the vendor-supplied kernel update containing the fix referenced in the upstream stable commits
On systems that do not require Bluetooth, disable or blacklist the hci_qca and btusb modules until patched
Restrict physical and radio proximity to critical Linux systems using Qualcomm Bluetooth controllers
Reboot systems after applying kernel updates to ensure the vulnerable module is unloaded

Patch Information

The upstream fix clears qca->qca_memdump and resets the memdump collection state before returning from the invalid-size path, aligning it with the cleanup used when hci_devcd_init() fails. Patched commits are available in the mainline and stable trees. Refer to the Kernel Patch Commit, Kernel Security Fix Commit, Kernel Update Commit, Kernel Code Change Commit, and Kernel Improvement Commit for exact source-level changes.

Workarounds

Disable Bluetooth entirely via systemctl disable --now bluetooth.service on hosts that do not require it
Blacklist the affected driver with echo "blacklist hci_qca" > /etc/modprobe.d/blacklist-hci_qca.conf and rebuild the initramfs
Operate affected devices only in RF-controlled environments until patched kernels are deployed

bash

# Configuration example: disable the hci_qca driver until a patched kernel is installed
sudo tee /etc/modprobe.d/blacklist-hci_qca.conf <<EOF
blacklist hci_qca
EOF
sudo rmmod hci_qca 2>/dev/null || true
sudo update-initramfs -u