CVE-2026-68391: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 6.0affected
  • 7b445e220db9a2c58be5d09bbbd322abf1b1452a and later · before 84674dd1d3192ecb050827d3148642609c0c9dbbaffected · git
  • 7b445e220db9a2c58be5d09bbbd322abf1b1452a and later · before b56f2ecafc08f372bf0529f9c4f3f429cb1702dcaffected · git
  • 7b445e220db9a2c58be5d09bbbd322abf1b1452a and later · before f915e74b6f18293d1d69a2a3305ef321ff7c0172affected · git
  • 7b445e220db9a2c58be5d09bbbd322abf1b1452a and later · before d5b3b484b62bb0f4542e7622789d28871626cdf0affected · git
  • 7b445e220db9a2c58be5d09bbbd322abf1b1452a and later · before ecdcb55ea1c01dda074406f38058785a69526734affected · git
  • 7b445e220db9a2c58be5d09bbbd322abf1b1452a and later · before da55f570191d5d72f10c607a7043b947eb05ea46affected · git
  • before 6.0not affected · semver
  • 6.1.189 and later · up to and including 6.1.*not affected · semver
  • 6.6.148 and later · up to and including 6.6.*not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation
  40Plan
• CVE-2026-74612veth: fix skb length accounting after XDP frag adjustment
  40Plan
• CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()
  40Plan

Published before and after this one in the same product

• ← EarlierCVE-2026-68386Aug 10, 2026 · bpf, sockmap: Reject unhashed UDP sockets on sockmap update
  0Monitor
• ← EarlierCVE-2026-68388Aug 10, 2026 · smb/client: handle overlapping allocated ranges in fallocate
  39Monitor
• Later →CVE-2026-68393Aug 10, 2026 · Bluetooth: hci_sync: extend conn_hash lookup critical sections
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.