{"id":"CVE-2026-68393","title":"Bluetooth: hci_sync: extend conn_hash lookup critical sections","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: extend conn_hash lookup critical sections\n\nUsing RCU-protected pointers outside the critical sections without\nrefcount is incorrect and may result …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < 83b7e67698d0b93f685875ce82c8d335436834f7","Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < 38326774df6198df0cc2744cc73bf77cb741c538","Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d","Linux eb8b860e87b296bd1874c79a668081efd00f9754","Linux 94bf6380e936339a700c0b3171a49baf512aa70b","Linux >= 6.12.28 < 6.13","Linux >= 6.14.6 < 6.15","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:47:58.636844Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:11.285Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68393","references":[{"url":"https://git.kernel.org/stable/c/83b7e67698d0b93f685875ce82c8d335436834f7"},{"url":"https://git.kernel.org/stable/c/38326774df6198df0cc2744cc73bf77cb741c538"},{"url":"https://git.kernel.org/stable/c/d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d"}],"tags":["cve.org"],"epss":0.00242,"epssPercentile":0.14302,"ingestedAt":"2026-10-16T17:24:46.863Z","slug":"CVE-2026-68393","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: extend conn_hash lookup critical sections\n\nUsing RCU-protected pointers outside the critical sections without\nrefcount is incorrect and may result to UAF.\n\nExtend critical section to cover both hci_conn_hash lookup and use of\nthe returned conn.\n\nAdd surrounding rcu_read_lock() also when return value is not used, in\npreparation for RCU lockdep requirement to hci_lookup_le_connect().\n\nThis avoids concurrent deletion of the conn before we are done\ndereferencing it.\n\nAlso, make sure to hold hdev->lock when accessing hdev->accept_list.\n\n## Affected\n\n- `Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < 83b7e67698d0b93f685875ce82c8d335436834f7`\n- `Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < 38326774df6198df0cc2744cc73bf77cb741c538`\n- `Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d`\n- `Linux eb8b860e87b296bd1874c79a668081efd00f9754`\n- `Linux 94bf6380e936339a700c0b3171a49baf512aa70b`\n- `Linux >= 6.12.28 < 6.13`\n- `Linux >= 6.14.6 < 6.15`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}