CVE-2026-68391

A flaw was found in the Linux kernel's Bluetooth management component. This vulnerability involves a Use-After-Free (UAF) condition, a type of memory corruption where the system attempts to use memory after it has been freed. This can occur due to improper handling of hci_conn pointers, potentially leading to arbitrary code execution or a denial of service.

Moderate impact has been assigned to this flaw for Red Hat Enterprise Linux because exploiting the race condition requires local access and precise timing during Bluetooth connection handling. Typical enterprise installations do not utilize Bluetooth hardware or run the subsystem, substantially minimizing real-world exposure. Where Bluetooth is actively utilized, a local user could potentially trigger memory corruption to cause a kernel crash or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.