What is the CVSS score of CVE-2026-68394?

CVE-2026-68394 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68394?

A critical Linux kernel vulnerability (CVE-2026-68394) could allow local attackers to gain root access and fully compromise affected systems.. A patch is available.

How to fix or mitigate CVE-2026-68394?

Within 24 hours, identify all systems running Linux kernels prior to versions 6.12.101, 6.18.42, 7.1.6, or 7.2-rc4 and assess which have local user access or Bluetooth MGMT socket exposure. Within 7 days, deploy patched kernel versions to non-production environments and conduct testing to validate stability before production rollout. Complete deployment of kernel versions 6.12.101, 6.18.42, 7.1.6, or 7.2-rc4 across all vulnerable production systems within 30 days, coordinating with change management to maintain service continuity.

Linux Kernel CVE-2026-68394

EUVD-2026-55580 HIGH

2026-08-10 Linux

GHSA-7rj8-gwgq-wrff

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition between two timed MGMT operations and a kworker callback warrants AC:H; PR:L because Bluetooth Management socket access with CAP_NET_ADMIN is required.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.4 HIGH

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:47 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:04 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

MGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hci_conn_params entry from hdev->le_conn_params. A later LOAD_CONN_PARAM request can clear disabled parameters and free that entry before hci_cmd_sync_work() runs the queued callback.

Do not keep the borrowed hci_conn_params pointer in queued work. Queue the hci_conn instead and hold a reference until the queued callback completes. When the work runs, revalidate that the connection is still present, look up the current hci_conn_params entry, and cancel the update if userspace removed that entry while the work was pending.

Copy the interval values from the current params entry under hdev->lock, then drop the lock and keep using hci_le_conn_update_sync() to issue the update.

Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in conn_update_sync+0x2a/0xf0 [bluetooth] Read of size 1 at addr ffff88810c697126 by task kworker/u17:0/377 Workqueue: hci0 hci_cmd_sync_work [bluetooth]

Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x5f0 kasan_report+0xe0/0x110 conn_update_sync+0x2a/0xf0 [bluetooth] hci_cmd_sync_work+0x187/0x210 [bluetooth] process_one_work+0x4fd/0xbc0 worker_thread+0x2d8/0x570 kthread+0x1ad/0x1f0 ret_from_fork+0x3c9/0x540 ret_from_fork_asm+0x1a/0x30

Allocated by task 466: hci_conn_params_add+0xa6/0x240 [bluetooth] load_conn_param+0x4e1/0x850 [bluetooth] hci_sock_sendmsg+0x96b/0xf80 [bluetooth]

Freed by task 474: kfree+0x313/0x590 hci_conn_params_clear_disabled+0x9b/0xc0 [bluetooth] load_conn_param+0x4bf/0x850 [bluetooth] hci_sock_sendmsg+0x96b/0xf80 [bluetooth]

AnalysisAI

Use-after-free in the Linux kernel's Bluetooth MGMT subsystem allows a local attacker with low-privilege Bluetooth Management socket access to corrupt kernel heap memory and potentially escalate privileges to root. The flaw exists in MGMT_OP_LOAD_CONN_PARAM handling, where a borrowed hci_conn_params pointer stored in a queued work item can be freed by a subsequent LOAD_CONN_PARAM call before hci_cmd_sync_work executes the callback - a race-driven use-after-free confirmed by KASAN. No public exploit or active exploitation has been identified at time of analysis; patches are available across stable kernel series 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4.

Technical ContextAI

The vulnerability resides in the Bluetooth Management (MGMT) protocol handler within the Linux kernel's Bluetooth stack. When MGMT_OP_LOAD_CONN_PARAM is invoked with parameters matching an existing Bluetooth LE central connection, it queues conn_update_sync() work via hci_cmd_sync_work. The original implementation stored a raw borrowed pointer to an hci_conn_params entry from the per-adapter hdev->le_conn_params list without acquiring a reference. A subsequent LOAD_CONN_PARAM call can invoke hci_conn_params_clear_disabled(), which calls kfree() on that same entry before the queued callback has a chance to run. This constitutes a classic use-after-free - effectively CWE-416, though NVD lists CWE as N/A. KASAN's slab-use-after-free report at conn_update_sync+0x2a/0xf0 in the bluetooth module, with a read of size 1 at a freed slab address by a kworker thread, provides high-confidence confirmation. The fix replaces the borrowed params pointer with a properly reference-counted hci_conn pointer, revalidating the params entry under hdev->lock at callback time and aborting the update if userspace has since removed the entry. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel release: 6.12.101, 6.18.42, 7.1.6, or 7.2-rc4 (or any later stable release). The upstream fix commits are available at https://git.kernel.org/stable/c/65ce6fe1b92112ba9064ded932c03180da3dd230, https://git.kernel.org/stable/c/57059ff14d81df4a970b2ea8d8f54431bb91a025, https://git.kernel.org/stable/c/b82802b5ab26a7c69fc2e7a0f2baa3c13a6c21aa, and https://git.kernel.org/stable/c/2bf282f8f715f5d05d6f4c49ffb3bd241c5e667e. As an immediate compensating control on systems where Bluetooth is not operationally required, blacklisting the bluetooth kernel module via adding 'blacklist bluetooth' to /etc/modprobe.d/blacklist.conf and rebooting eliminates the attack surface entirely with no functional trade-off for non-Bluetooth workloads. On systems requiring Bluetooth, restrict HCI Management socket access to only users with CAP_NET_ADMIN (typically only root or explicitly privileged service accounts) to reduce the pool of potential local attackers, accepting the trade-off that unprivileged Bluetooth management tools will be blocked.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68394 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68394

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code