CVE-2026-68394

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

MGMT_OP_LOAD_CONN_PARAM queues conn_update_sync() when a single parameter

update changes an existing LE central connection. The queued work currently

stores a borrowed hci_conn_params entry from hdev->le_conn_params. A later

LOAD_CONN_PARAM request can clear disabled parameters and free that entry

before hci_cmd_sync_work() runs the queued callback.

Do not keep the borrowed hci_conn_params pointer in queued work. Queue the

hci_conn instead and hold a reference until the queued callback completes.

When the work runs, revalidate that the connection is still present, look

up the current hci_conn_params entry, and cancel the update if userspace

removed that entry while the work was pending.

Copy the interval values from the current params entry under hdev->lock,

then drop the lock and keep using hci_le_conn_update_sync() to issue the

update.

Validation reproduc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References