CVE-2026-68393: Linux Kernel Bluetooth Use-After-Free

CVE-2026-68393 Overview

CVE-2026-68393 is a use-after-free (UAF) vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the hci_sync component. The flaw stems from improper use of RCU-protected pointers outside of RCU critical sections without holding a refcount. An attacker within Bluetooth range can trigger concurrent deletion of a connection object while it is still being dereferenced, resulting in memory corruption. Kernel maintainers resolved the issue by extending the RCU critical section to cover both the hci_conn_hash lookup and use of the returned connection, and by ensuring hdev->lock is held when accessing hdev->accept_list.

Critical Impact
Adjacent-network attackers can trigger a use-after-free in the Linux Bluetooth stack, leading to kernel memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/hci_sync.c)
Linux stable branches prior to commits 38326774, 83b7e676, and d5efd6e4
Distributions shipping vulnerable kernel versions with Bluetooth enabled

Discovery Timeline

2026-08-10 - CVE-2026-68393 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68393

Vulnerability Analysis

The vulnerability resides in the Bluetooth Host Controller Interface (HCI) synchronization code. The kernel uses Read-Copy-Update (RCU) to protect connection hash lookups performed through hci_conn_hash and hci_lookup_le_connect(). RCU-protected pointers must be dereferenced only within an RCU read-side critical section, or with an explicit reference count held on the object.

The original code dereferenced connection pointers returned from the hash lookup after leaving the RCU critical section without acquiring a refcount. A concurrent thread could free the connection object between the lookup and its subsequent use, leaving a dangling pointer. Additionally, hdev->accept_list was accessed without holding hdev->lock, exposing another race window.

Root Cause

The root cause is incorrect RCU usage in the Bluetooth hci_sync code path. RCU-protected pointers were used outside the critical section without an accompanying reference count, violating RCU synchronization semantics. Missing lock coverage on hdev->accept_list compounded the issue by permitting concurrent modification of shared state.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be within Bluetooth radio range of the target. The attacker manipulates Bluetooth Low Energy (BLE) connection state transitions to race connection lookup and deletion. Successful exploitation corrupts kernel memory, which can cause a kernel panic (denial of service) or, with sufficient control over the freed object, enable local privilege escalation. No user interaction or authentication is required.

The vulnerability mechanism is described in the kernel commit messages referenced in this advisory. See the Kernel Git Commit 38326774, Kernel Git Commit 83b7e676, and Kernel Git Commit d5efd6e4 for the authoritative fix details.

Detection Methods for CVE-2026-68393

Indicators of Compromise

Unexpected kernel oops or panic messages referencing hci_sync, hci_conn_hash_lookup, or hci_lookup_le_connect in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports of use-after-free in the Bluetooth subsystem
Repeated Bluetooth stack crashes coinciding with nearby unknown BLE devices attempting connections

Detection Strategies

Enable KASAN or KFENCE on test kernels to surface UAF conditions in the Bluetooth path
Monitor kernel ring buffer for stack traces originating in net/bluetooth/hci_sync.c
Audit installed kernel versions against the upstream fix commits to identify unpatched hosts

Monitoring Recommendations

Ship kernel logs to a centralized logging platform and alert on Bluetooth-related oops or KASAN traces
Track Bluetooth interface state changes and abnormal connection churn on endpoints that expose BLE
Inventory endpoints with Bluetooth radios enabled, especially laptops and IoT devices in high-traffic environments

How to Mitigate CVE-2026-68393

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 38326774, 83b7e676, and d5efd6e4 or upgrade to a distribution kernel that includes them
Disable the Bluetooth stack on systems where it is not required until patches are deployed
Restrict physical proximity access to sensitive endpoints in shared or public environments

Patch Information

The fix extends the RCU critical section so that both the hci_conn_hash lookup and the subsequent use of the returned connection occur under rcu_read_lock(). The patch also adds rcu_read_lock() around callers of hci_lookup_le_connect() even when the return value is unused, satisfying RCU lockdep requirements. Access to hdev->accept_list is now guarded by hdev->lock. Refer to the Kernel Git Commit 38326774 for the authoritative fix.

Workarounds

Unload the Bluetooth kernel modules with rmmod btusb bluetooth on hosts that do not require Bluetooth
Blacklist Bluetooth modules via /etc/modprobe.d/blacklist-bluetooth.conf to prevent them from loading at boot
Disable Bluetooth radios in firmware or BIOS on servers and workstations that never use the feature

bash

# Configuration example: disable Bluetooth kernel modules
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo "blacklist btusb" | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
sudo rmmod btusb bluetooth 2>/dev/null || true