CVE-2026-68390: Linux Kernel Race Condition Vulnerability

CVE-2026-68390 Overview

CVE-2026-68390 is a race condition vulnerability in the Linux kernel Bluetooth subsystem. The flaw resides in the hci_sync code path, where hci_conn_params_lookup is invoked without holding the required hdev->lock. Without the lock, concurrent list iteration and parameter access on the hci_conn_params list are unsafe, opening the door to memory corruption or use-after-free conditions.

An attacker within Bluetooth range can trigger the unsafe code path through crafted connection activity. The vulnerability affects host integrity, confidentiality, and availability on systems with Bluetooth enabled.

Critical Impact
An adjacent attacker can exploit the missing lock in hci_sync to corrupt kernel memory, leading to potential privilege escalation, information disclosure, or denial of service on Linux systems with active Bluetooth.

Affected Products

Linux kernel — mainline versions containing the unlocked hci_conn_params_lookup call in hci_sync
Linux distributions shipping affected stable kernels with Bluetooth (CONFIG_BT) enabled
Devices exposing Bluetooth host controllers (laptops, servers with BT dongles, embedded devices)

Discovery Timeline

2026-08-10 - CVE-2026-68390 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68390

Vulnerability Analysis

The Linux kernel Bluetooth stack maintains a per-device list of connection parameters (hci_conn_params) attached to each HCI device (hdev). Access to this list is governed by hdev->lock. The hci_conn_params_lookup helper walks the list and returns matching entries, and its documented contract requires the caller to hold hdev->lock for the duration of the lookup and any subsequent use of the returned pointer.

In the affected code, callers inside hci_sync invoked hci_conn_params_lookup without holding hdev->lock. Because Bluetooth workqueue tasks, mgmt commands, and HCI event handlers can concurrently add, remove, or free entries on this list, the unlocked lookup exposes the kernel to a classic time-of-check-to-time-of-use race. The result is unsafe list iteration and unsafe access to parameter fields returned by the lookup.

The fix, applied in kernel commits 8d892bec1dd134761cabec6ba23fe315d0f20f98 and c363202ec841df36421ec280eea3d5f94f556143, acquires hdev->lock around the affected hci_conn_params lookups in hci_sync.

Root Cause

The root cause is a missing lock acquisition, a synchronization defect in kernel Bluetooth code. hci_sync performed lookups on a shared linked list without holding the lock that serializes readers and writers of that list. Concurrent modification during traversal can produce dangling pointers, torn reads, or use-after-free of hci_conn_params entries.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be within Bluetooth radio range of a vulnerable host. The attacker does not need credentials or user interaction. Crafted connection attempts, pairing sequences, or repeated management events can be used to increase contention on hci_conn_params and trigger the race window. Successful exploitation can corrupt kernel memory structures, enabling denial of service or, in favorable conditions, kernel privilege escalation.

No verified public proof-of-concept code is available at the time of publication. See the upstream commits 8d892bec1dd1 and c363202ec841 for the exact code sites and fix.

Detection Methods for CVE-2026-68390

Indicators of Compromise

Unexpected kernel oops or panic messages referencing hci_sync, hci_conn_params_lookup, or the Bluetooth subsystem in dmesg or /var/log/kern.log.
KASAN or lockdep warnings citing use-after-free or unsafe list traversal in net/bluetooth/hci_sync.c.
Repeated Bluetooth connection or pairing attempts from unknown peers in HCI logs (btmon capture).

Detection Strategies

Query installed kernel version against the fixed commits and flag hosts running unpatched builds with Bluetooth enabled.
Enable KASAN and lockdep on test kernels to surface racy access to hci_conn_params during fuzzing or QA.
Monitor endpoint telemetry for kernel crash signatures involving the Bluetooth stack, then correlate with proximity events.

Monitoring Recommendations

Ship dmesg, journald, and kernel.log events to a central log store and alert on Bluetooth subsystem stack traces.
Capture Bluetooth HCI traffic on high-risk hosts using btmon when investigating suspected exploitation.
Track kernel package versions across the fleet and alert on hosts drifting behind the vendor-patched baseline.

How to Mitigate CVE-2026-68390

Immediate Actions Required

Apply the vendor-provided kernel update that includes commits 8d892bec1dd1 and c363202ec841 as soon as it is available for your distribution.
Disable Bluetooth on systems that do not require it by unloading the bluetooth and btusb modules or masking the bluetooth.service unit.
Restrict physical and radio proximity to critical hosts until patches are deployed.

Patch Information

The upstream fix holds hdev->lock around hci_conn_params lookups in hci_sync. The relevant stable-tree commits are 8d892bec1dd134761cabec6ba23fe315d0f20f98 and c363202ec841df36421ec280eea3d5f94f556143. Consume the fix through your distribution's kernel updates rather than cherry-picking manually where possible.

Workarounds

Unload Bluetooth kernel modules on servers and endpoints that do not use Bluetooth: rmmod btusb bluetooth.
Blacklist the Bluetooth modules in /etc/modprobe.d/ to prevent them from loading at boot.
Set Bluetooth adapters to non-discoverable and non-connectable mode where the service must remain enabled.

bash

# Disable and blacklist Bluetooth until the kernel is patched
sudo systemctl disable --now bluetooth.service
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo update-initramfs -u

# Verify no Bluetooth modules are loaded after reboot
lsmod | grep -E 'bluetooth|btusb'