---
id: CVE-2026-68393
title: 'Bluetooth: hci_sync: extend conn_hash lookup critical sections'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: extend conn_hash lookup critical sections

  Using RCU-protected pointers outside the critical sections without
  refcount is incorrect and may result …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d <
    83b7e67698d0b93f685875ce82c8d335436834f7
  - >-
    Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d <
    38326774df6198df0cc2744cc73bf77cb741c538
  - >-
    Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d <
    d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d
  - Linux eb8b860e87b296bd1874c79a668081efd00f9754
  - Linux 94bf6380e936339a700c0b3171a49baf512aa70b
  - Linux >= 6.12.28 < 6.13
  - Linux >= 6.14.6 < 6.15
  - Linux 6.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:47:58.636844Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:11.285Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68393'
references:
  - url: 'https://git.kernel.org/stable/c/83b7e67698d0b93f685875ce82c8d335436834f7'
  - url: 'https://git.kernel.org/stable/c/38326774df6198df0cc2744cc73bf77cb741c538'
  - url: 'https://git.kernel.org/stable/c/d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d'
tags:
  - cve.org
epss: 0.00242
epssPercentile: 0.14302
ingestedAt: '2026-10-16T17:24:46.863Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: extend conn_hash lookup critical sections

Using RCU-protected pointers outside the critical sections without
refcount is incorrect and may result to UAF.

Extend critical section to cover both hci_conn_hash lookup and use of
the returned conn.

Add surrounding rcu_read_lock() also when return value is not used, in
preparation for RCU lockdep requirement to hci_lookup_le_connect().

This avoids concurrent deletion of the conn before we are done
dereferencing it.

Also, make sure to hold hdev->lock when accessing hdev->accept_list.

## Affected

- `Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < 83b7e67698d0b93f685875ce82c8d335436834f7`
- `Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < 38326774df6198df0cc2744cc73bf77cb741c538`
- `Linux >= 6d0417e4e1cf66fd917f06f0454958362714ef7d < d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d`
- `Linux eb8b860e87b296bd1874c79a668081efd00f9754`
- `Linux 94bf6380e936339a700c0b3171a49baf512aa70b`
- `Linux >= 6.12.28 < 6.13`
- `Linux >= 6.14.6 < 6.15`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.