What is the CVSS score of CVE-2026-68390?

CVE-2026-68390 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68390?

Organizations operating Linux systems with Bluetooth connectivity face a kernel-level vulnerability (CVE-2026-68390, CVSS 8.8) that could enable attackers with physical proximity to gain unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-68390?

Within 24 hours, inventory all Linux systems with Bluetooth enabled and identify those running kernels from commit c530569adc19b5f0c62955de41f067bad34e3fe0 onward. Within 7 days, deploy the available vendor patch to all production systems and high-risk endpoints. Within 30 days, complete patching across all remaining affected systems and verify remediation through kernel version audits.

Linux Kernel CVE-2026-68390

EUVD-2026-55576 HIGH

2026-08-10 Linux

GHSA-rqw2-7c22-q555

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:A confirmed for Bluetooth proximity requirement; AC:H assigned instead of vendor AC:L because reliable race condition exploitation requires precise timing and repeated attempts.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:51 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

8.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:04 cve.org

HIGH 8.8

CVE Published

Aug 10, 2026 - 12:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups

hci_conn_params_lookup requires hdev->lock be held, otherwise the list iteration or param access is not safe.

Hold hdev->lock for params lookups in hci_sync.

AnalysisAI

Missing mutex protection in the Linux kernel's Bluetooth HCI synchronization layer creates a race condition when hci_conn_params_lookup is called without holding hdev->lock, enabling unsafe concurrent list iteration and parameter access at kernel level. All Linux kernel builds spanning commit c530569adc19b5f0c62955de41f067bad34e3fe0 up to the respective fix commits are affected when the Bluetooth subsystem is active. An adjacent, unauthenticated attacker within Bluetooth radio range could exploit this race window to achieve kernel-level memory corruption, information disclosure, or potentially arbitrary code execution. No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.15% (5th percentile) reflects low current weaponization despite the elevated CVSS base score.

Technical ContextAI

The vulnerability resides in hci_sync.c within the Linux kernel's Bluetooth HCI (Host Controller Interface) synchronization subsystem. The function hci_conn_params_lookup iterates over a kernel-managed linked list of Bluetooth connection parameters, which is protected by the hdev->lock mutex. When called without first acquiring that lock, concurrent kernel threads - triggered by Bluetooth events, connection state changes, or incoming pairing attempts - can race to modify or free list entries while traversal is in progress. This constitutes an improper locking flaw (analogous to CWE-667) whose downstream consequences include use-after-free (CWE-416) and data corruption during list traversal. CPE data (cpe:2.3:a:linux:linux) confirms the vulnerability spans mainline and stable kernel trees without a version-bounded upper limit in NVD. Two fix commits (c363202ec841df36421ec280eea3d5f94f556143 and 8d892bec1dd134761cabec6ba23fe315d0f20f98) enforce lock acquisition around all hci_conn_params_lookup call sites within hci_sync.

RemediationAI

The primary remediation is to apply the upstream kernel fix commits available at https://git.kernel.org/stable/c/c363202ec841df36421ec280eea3d5f94f556143 and https://git.kernel.org/stable/c/8d892bec1dd134761cabec6ba23fe315d0f20f98. Major Linux distributions (Debian, Ubuntu, RHEL, SUSE, Arch) typically backport kernel security patches to their stable package streams - consult each distribution's security tracker for the specific patched kernel package version applicable to your deployment. If immediate kernel update is not feasible, disabling the Bluetooth subsystem by unloading kernel modules (rmmod btusb bluetooth) or using rfkill block bluetooth eliminates the attack surface entirely, at the cost of all Bluetooth functionality including HID peripherals such as keyboards and mice. Restricting physical or RF proximity access (e.g., policy-enforced Bluetooth disable via rfkill at boot) provides a partial compensating control but does not patch the underlying flaw. Systems where Bluetooth is not operationally required should disable it permanently via kernel boot parameter or module blacklist.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68390 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68390

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code