CVE-2026-68394

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the Bluetooth MGMT component. The MGMT OP LOAD CONN PARAM operation queues the conn update sync() function when a parameter update modifies an existing LE central connection. The queued work stores a borrowed hci conn params entry from hdev->le conn params. A subsequent LOAD CONN PARAM request can clear disabled parameters and free that entry before the hci cmd sync work() function executes the queued callback, leading to a memory access violation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.