CVE-2026-68189 Linux CVE debrief

Who should care

Linux kernel users and administrators, particularly those responsible for managing Linux-based systems, should be aware of this vulnerability and take steps to patch their systems. This includes reviewing and updating Linux kernel configurations to ensure the fix is applied. Security teams and vulnerability management teams should prioritize patching and monitor for potential related vulnerabilities. Additionally, operators and maintainers of systems using the affected Linux kernel versions should assess their exposure and take appropriate actions to mitigate risks.

Technical summary

The Linux kernel's Bluetooth subsystem had a use-after-free vulnerability. The hci_sync conversion moved class-of-device and EIR generation from an HCI request built under hdev->lock to asynchronous command sync work. The worker holds hdev->req_lock, but that lock does not serialize access to hdev->uuids against add_uuid() and remove_uuid(), which update the list under hdev->lock. This interleaving could occur: CPU0 (command sync work) fetches uuid from the list, while CPU1 (management socket) deletes and frees the uuid, leading to a use-after-free. KASAN reported the resulting use-after-free. Holding hdev->lock while generating and committing the class-of-device and EIR snapshots fixes the issue.

Defensive priority

This vulnerability has a high CVSS score of 7.8 and is classified as HIGH severity. Linux kernel users should prioritize patching.

Recommended defensive actions

• Apply the patch from the Linux kernel stable repository.
• Review and update Linux kernel configurations to ensure the fix is applied.
• Monitor Linux kernel updates for potential related vulnerabilities.
• Perform a thorough review of system configurations and exposed assets.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets.
• Close the item only after evidence of successful patching and verification is documented.

Evidence notes

The CVE record provides details about a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem. Holding the hdev->lock while generating and committing class-of-device and EIR snapshots fixes the issue. Evidence is limited to public sources and may not cover all affected systems or potential impacts. Defenders should verify patch application, review system configurations, and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.