CVE-2026-68389

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth hci qca component where the qca controller memdump() function fails to properly clear the memdump state when a controller reports a zero dump size. In this scenario, the local qca memdump object is freed, but the qca->qca memdump pointer and the collection state remain active. Consequently, subsequent memdump work items may use the stale pointer to operate on freed memory. Additionally, the persistent IBS-disabled flags and collection state can block transmit handling or other waiters behind an aborted dump.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.