PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-68189 Linux CVE debrief

The Linux kernel's Bluetooth subsystem has a use-after-free vulnerability due to a race condition between asynchronous command sync work and management socket operations. Holding the hdev->lock during class-of-device and EIR snapshot generation and commit prevents the interleaving that leads to the use-after-free. This fix protects UUID list walks and restores serialization lost in the command sync conversion. Linux kernel users, particularly those managing Linux-based systems, should be aware and take steps to patch their systems, reviewing and updating kernel configurations to ensure the fix is applied. Security and vulnerability management teams should prioritize patching and monitor for related vulnerabilities. Operators and maintainers of systems using affected Linux kernel versions should assess exposure and mitigate risks. Evidence is limited to public sources and may not cover all affected systems or potential impacts. Defenders should verify patch application, review system configurations, and monitor for exploitation attempts.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-10
Original CVE updated
2026-08-19
Advisory published
2026-08-10
Advisory updated
2026-08-19

Who should care

Linux kernel users and administrators, particularly those responsible for managing Linux-based systems, should be aware of this vulnerability and take steps to patch their systems. This includes reviewing and updating Linux kernel configurations to ensure the fix is applied. Security teams and vulnerability management teams should prioritize patching and monitor for potential related vulnerabilities. Additionally, operators and maintainers of systems using the affected Linux kernel versions should assess their exposure and take appropriate actions to mitigate risks.

Technical summary

The Linux kernel's Bluetooth subsystem had a use-after-free vulnerability. The hci_sync conversion moved class-of-device and EIR generation from an HCI request built under hdev->lock to asynchronous command sync work. The worker holds hdev->req_lock, but that lock does not serialize access to hdev->uuids against add_uuid() and remove_uuid(), which update the list under hdev->lock. This interleaving could occur: CPU0 (command sync work) fetches uuid from the list, while CPU1 (management socket) deletes and frees the uuid, leading to a use-after-free. KASAN reported the resulting use-after-free. Holding hdev->lock while generating and committing the class-of-device and EIR snapshots fixes the issue.

Defensive priority

This vulnerability has a high CVSS score of 7.8 and is classified as HIGH severity. Linux kernel users should prioritize patching.

Recommended defensive actions

  • Apply the patch from the Linux kernel stable repository.
  • Review and update Linux kernel configurations to ensure the fix is applied.
  • Monitor Linux kernel updates for potential related vulnerabilities.
  • Perform a thorough review of system configurations and exposed assets.
  • Implement compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions and retest remediated assets.
  • Close the item only after evidence of successful patching and verification is documented.

Evidence notes

The CVE record provides details about a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem. Holding the hdev->lock while generating and committing class-of-device and EIR snapshots fixes the issue. Evidence is limited to public sources and may not cover all affected systems or potential impacts. Defenders should verify patch application, review system configurations, and monitor for potential exploitation attempts.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T13:20:06.187Z and has not been modified since then.