High [CVE-2026-68393] Linux kernel: Bluetooth hci_sync use-after-free vulnerability

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: extend conn_hash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hci_conn_hash lookup and use of the returned conn.

Add surrounding rcu_read_lock() also when return value is not used, in preparation for RCU lockdep requirement to hci_lookup_le_connect(). This avoids concurrent deletion of the conn before we are done dereferencing it.

Also, make sure to hold hdev->lock when accessing hdev->accept_list. This vulnerability arises from the incorrect handling of Read-Copy-Update (RCU) protected pointers outside their designated critical sections without proper reference counting.

An attacker could exploit this by triggering a race condition, leading to a Use-After-Free (UAF) error. This could result in system instability, denial of service, or potentially the execution of arbitrary code.

Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825.

Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux for NVIDIA 26; Red Hat OpenShift Container Platform 4 as not affected.