CVE-2026-68394: Linux Kernel Bluetooth Use-After-Free

CVE-2026-68394 Overview

CVE-2026-68394 is a use-after-free vulnerability in the Linux kernel Bluetooth management (MGMT) subsystem. The flaw resides in the MGMT_OP_LOAD_CONN_PARAM handler, which queues conn_update_sync() when a single parameter update modifies an existing Low Energy (LE) central connection. The queued work stores a borrowed hci_conn_params entry from hdev->le_conn_params. A subsequent LOAD_CONN_PARAM request can clear disabled parameters and free that entry before hci_cmd_sync_work() executes the queued callback, producing a slab use-after-free read.

Critical Impact
A local user with Bluetooth management privileges can trigger a use-after-free in kernel memory, potentially leading to privilege escalation, information disclosure, or system compromise.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth)
Systems using LE central mode Bluetooth connections
Distributions shipping unpatched kernel versions prior to the referenced stable commits

Discovery Timeline

2026-08-10 - CVE-2026-68394 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68394

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Bluetooth MGMT interface. When userspace issues MGMT_OP_LOAD_CONN_PARAM and a single parameter update targets an active LE central connection, the kernel queues conn_update_sync() to run later via hci_cmd_sync_work(). The queued work retains a raw pointer to an hci_conn_params entry owned by hdev->le_conn_params.

This pointer is not reference-counted or otherwise pinned. A second LOAD_CONN_PARAM request can invoke hci_conn_params_clear_disabled(), which frees the borrowed entry via kfree(). When the queued callback subsequently executes, conn_update_sync() dereferences the freed slab object, resulting in a read of freed memory as reported by KASAN.

Root Cause

The root cause is unsafe lifetime management of the hci_conn_params structure across asynchronous work boundaries. The producer path in load_conn_param() allocates or references the entry under hdev->lock, but the queued consumer executes after the lock is released. No reference count, ownership transfer, or revalidation step protects the borrowed pointer, so a concurrent LOAD_CONN_PARAM freeing the entry produces a classic use-after-free.

Attack Vector

Exploitation requires local access with the ability to issue Bluetooth MGMT commands through hci_sock_sendmsg(). An attacker races two LOAD_CONN_PARAM operations against an existing LE central connection. The first queues conn_update_sync() with a borrowed pointer. The second frees that entry through hci_conn_params_clear_disabled() before the workqueue runs. The kernel then reads freed slab memory in conn_update_sync(), which an attacker can use to leak kernel state or, with heap grooming, corrupt adjacent objects.

The upstream fix queues the hci_conn instead of the hci_conn_params pointer, holds a reference to the connection until the callback completes, revalidates connection presence when work runs, and re-looks-up the current params entry under hdev->lock before copying interval values.

Detection Methods for CVE-2026-68394

Indicators of Compromise

KASAN reports containing slab-use-after-free in conn_update_sync originating from the bluetooth module
Kernel workqueue traces referencing hci_cmd_sync_work followed by unexpected oops or panic events
Repeated high-frequency MGMT_OP_LOAD_CONN_PARAM operations from a single unprivileged process

Detection Strategies

Enable KASAN on test kernels to catch use-after-free reads in conn_update_sync before deployment
Audit hci_sock_sendmsg call patterns for anomalous bursts of LOAD_CONN_PARAM commands
Correlate Bluetooth subsystem oops messages with process telemetry to identify local exploitation attempts

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized SIEM and alert on KASAN or slab-use-after-free signatures
Track process capabilities and monitor unprivileged processes issuing raw Bluetooth HCI socket calls
Baseline normal Bluetooth MGMT activity on endpoints so anomalous LE parameter update floods trigger alerts

How to Mitigate CVE-2026-68394

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 2bf282f, 57059ff, 65ce6fe, and b82802b as they land in your distribution's stable kernel
Restrict access to Bluetooth HCI raw sockets by limiting CAP_NET_ADMIN and CAP_NET_RAW to trusted service accounts
On servers and infrastructure without a Bluetooth requirement, unload the bluetooth kernel module or blocklist it in modprobe configuration

Patch Information

The fix is committed to the Linux stable tree. Relevant commits include Kernel Commit 2bf282f, Kernel Commit 57059ff, Kernel Commit 65ce6fe, and Kernel Commit b82802b. The patch queues the hci_conn and holds a reference until the callback completes, then revalidates the connection and re-looks-up the current hci_conn_params entry under hdev->lock.

Workarounds

Disable the Bluetooth stack on systems where it is not required using systemctl disable --now bluetooth and blocklisting the module
Deny non-root users access to /dev/rfkill and Bluetooth management sockets through udev rules or SELinux policy
Where Bluetooth must remain enabled, restrict which user sessions can invoke MGMT operations by enforcing BlueZ D-Bus policy on org.bluez interfaces

bash

# Configuration example: blocklist the Bluetooth module on servers
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo modprobe -r btusb bluetooth