High 7.8Published Aug 10, 2026

CVE-2026-68391Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

Updated under an hour ago (Oct 27, 2026, 1:40 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hci_conn in hci_sync callbacks also needs to hold refcount to avoid UAF. Take appropriate locks for hci_conn lookups, and take refcount for hci_conn pointers stored in mgmt_pending_cmd so that the pointer stays valid. When accessing conn->state, ensure hdev->lock is held to avoid data race.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before 84674dd1d3192ecb050827d3148642609c0c9dbb; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before b56f2ecafc08f372bf0529f9c4f3f429cb1702dc; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before f915e74b6f18293d1d69a2a3305ef321ff7c0172; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before d5b3b484b62bb0f4542e7622789d28871626cdf0; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before ecdcb55ea1c01dda074406f38058785a69526734; from 7b445e220db9a2c58be5d09bbbd322abf1b1452a before da55f570191d5d72f10c607a7043b947eb05ea46	CNA record

References

References

https://git.kernel.org/stable/c/84674dd1d3192ecb050827d3148642609c0c9dbb
https://git.kernel.org/stable/c/b56f2ecafc08f372bf0529f9c4f3f429cb1702dc
https://git.kernel.org/stable/c/f915e74b6f18293d1d69a2a3305ef321ff7c0172
https://git.kernel.org/stable/c/d5b3b484b62bb0f4542e7622789d28871626cdf0
https://git.kernel.org/stable/c/ecdcb55ea1c01dda074406f38058785a69526734
https://git.kernel.org/stable/c/da55f570191d5d72f10c607a7043b947eb05ea46

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.