CVE-2026-68189

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Bluetooth component due to improper synchronization during UUID list traversal. The hci sync conversion moved class-of-device and EIR generation to asynchronous command sync work. While the worker holds hdev->req lock, this lock fails to serialize access to hdev->uuids against the add uuid() and remove uuid() functions, which operate under hdev->lock. This can lead to a race condition where a UUID is freed by one CPU while another CPU is still attempting to read its size, resulting in a slab-use-after-free in the eir create() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.