CVE-2026-68389

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68389", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.388Z", "datePublished": "2026-08-10T12:04:08.306Z", "dateUpdated": "2026-08-17T05:04:36.839Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:04:36.839Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_qca: Clear memdump state on invalid dump size\n\nqca_controller_memdump() allocates qca->qca_memdump before processing\nthe first dump packet. For a sequence-zero packet it then disables IBS,\nmarks memdump collection active, and reads the advertised dump size.\n\nIf the controller reports a zero dump size, the error path frees the\nlocal qca_memdump object and returns without clearing qca->qca_memdump\nor undoing the collection state. A later memdump work item initializes\nits local pointer from qca->qca_memdump and skips allocation when that\npointer is non-NULL, so it can operate on freed memory. The stale\ncollection and IBS-disabled flags can also leave waiters or later\ntransmit handling blocked behind an aborted dump.\n\nClear the saved pointer and memdump state before returning from the\ninvalid-size path, matching the cleanup used when hci_devcd_init() fails.\n\nA static analysis checker reported the stale memdump state, and manual\nsource review confirmed the invalid-size failure path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable memdump packets arrive as QCA vendor HCI events (QCA_SSR_DUMP_HANDLE) emitted by the Bluetooth controller after a firmware crash/SSR, a state a nearby attacker induces or controls by attacking QCA controller firmware over the radio link, matching the CNA convention of scoring controller-event-driven Bluetooth driver bugs as Adjacent.\nAC:L - An attacker controlling the controller-to-host HCI stream deterministically triggers the flaw by sending a sequence-0 memdump packet with dump_size 0 followed by any further memdump packet; there is no race and no attacker-uncontrollable timing or memory-layout precondition.\nPR:N - No host credentials or authentication are needed: the memdump event is consumed unconditionally by qca_recv_event() on the driver receive path with no pairing, bonding, or capability check before qca_controller_memdump() runs.\nUI:N - SSR/memdump handling is fully automatic \u2014 qca_controller_memdump_event() queues the work item on receipt, so no local user has to open, mount, or confirm anything.\nS:U - The dangling pointer, use-after-free writes, and double free all occur in the host kernel's own heap and authority; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - The stale qca->qca_memdump gives a use-after-free on a kmalloc-16 object that an attacker can reclaim with another kernel allocation, and the freed fields (received_dump/ram_dump_size) then drive hci_devcd_append() length arithmetic, yielding attacker-influenced kernel memory disclosure per UAF exploitation.\nI:H - The reused freed object receives attacker-supplied 32-bit values (ram_dump_size straight from the packet, plus current_seq_no/received_dump) and is later kfree()d again, providing a controlled heap write and double-free primitive usable for arbitrary write and control-flow hijack.\nA:H - Beyond the use-after-free/double-free oops (KASAN slab-use-after-free), the uncleared QCA_MEMDUMP_COLLECTION and QCA_IBS_DISABLED flags leave wait_on_bit_timeout() waiters and the IBS transmit path stalled behind an aborted dump, persistently wedging the Bluetooth device."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/hci_qca.c"], "versions": [{"version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "lessThan": "5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a", "status": "affected", "versionType": "git"}, {"version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "lessThan": "069258d5111eed9ac9586bee42d03d38e2975715", "status": "affected", "versionType": "git"}, {"version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "lessThan": "cefb44c367b2b52e50f97bc8526d39df9bcf5e60", "status": "affected", "versionType": "git"}, {"version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "lessThan": "2363a757694752426fc47f3eadde15cf5f791fa5", "status": "affected", "versionType": "git"}, {"version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "lessThan": "bf587a10c33e5571a299742e45bc18960b9912e7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/bluetooth/hci_qca.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a"}, {"url": "https://git.kernel.org/stable/c/069258d5111eed9ac9586bee42d03d38e2975715"}, {"url": "https://git.kernel.org/stable/c/cefb44c367b2b52e50f97bc8526d39df9bcf5e60"}, {"url": "https://git.kernel.org/stable/c/2363a757694752426fc47f3eadde15cf5f791fa5"}, {"url": "https://git.kernel.org/stable/c/bf587a10c33e5571a299742e45bc18960b9912e7"}], "title": "Bluetooth: hci_qca: Clear memdump state on invalid dump size", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/bluetooth/hci_qca.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a", "status": "affected", "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "versionType": "git"}, {"lessThan": "069258d5111eed9ac9586bee42d03d38e2975715", "status": "affected", "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "versionType": "git"}, {"lessThan": "cefb44c367b2b52e50f97bc8526d39df9bcf5e60", "status": "affected", "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "versionType": "git"}, {"lessThan": "2363a757694752426fc47f3eadde15cf5f791fa5", "status": "affected", "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "versionType": "git"}, {"lessThan": "bf587a10c33e5571a299742e45bc18960b9912e7", "status": "affected", "version": "06d3fdfcdf5cefb06f2024b9d3dad356779399cf", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/bluetooth/hci_qca.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_qca: Clear memdump state on invalid dump size\n\nqca_controller_memdump() allocates qca->qca_memdump before processing\nthe first dump packet. For a sequence-zero packet it then disables IBS,\nmarks memdump collection active, and reads the advertised dump size.\n\nIf the controller reports a zero dump size, the error path frees the\nlocal qca_memdump object and returns without clearing qca->qca_memdump\nor undoing the collection state. A later memdump work item initializes\nits local pointer from qca->qca_memdump and skips allocation when that\npointer is non-NULL, so it can operate on freed memory. The stale\ncollection and IBS-disabled flags can also leave waiters or later\ntransmit handling blocked behind an aborted dump.\n\nClear the saved pointer and memdump state before returning from the\ninvalid-size path, matching the cleanup used when hci_devcd_init() fails.\n\nA static analysis checker reported the stale memdump state, and manual\nsource review confirmed the invalid-size failure path."}], "id": "CVE-2026-68389", "lastModified": "2026-08-17T06:17:47.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:32.200", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/069258d5111eed9ac9586bee42d03d38e2975715"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2363a757694752426fc47f3eadde15cf5f791fa5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf587a10c33e5571a299742e45bc18960b9912e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cefb44c367b2b52e50f97bc8526d39df9bcf5e60"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux Kernel: Bluetooth driver memory corruption and denial of service", "id": "2513315", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513315"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: hci_qca: Clear memdump state on invalid dump size\nqca_controller_memdump() allocates qca->qca_memdump before processing\nthe first dump packet. For a sequence-zero packet it then disables IBS,\nmarks memdump collection active, and reads the advertised dump size.\nIf the controller reports a zero dump size, the error path frees the\nlocal qca_memdump object and returns without clearing qca->qca_memdump\nor undoing the collection state. A later memdump work item initializes\nits local pointer from qca->qca_memdump and skips allocation when that\npointer is non-NULL, so it can operate on freed memory. The stale\ncollection and IBS-disabled flags can also leave waiters or later\ntransmit handling blocked behind an aborted dump.\nClear the saved pointer and memdump state before returning from the\ninvalid-size path, matching the cleanup used when hci_devcd_init() fails.\nA static analysis checker reported the stale memdump state, and manual\nsource review confirmed the invalid-size failure path.", "A flaw was found in the Bluetooth Host Controller Interface (HCI) Qualcomm Atheros (QCA) driver within the Linux kernel. This vulnerability occurs when the controller reports an invalid (zero) memory dump size, leading to improper state cleanup. An attacker could potentially exploit this to cause memory corruption by operating on freed memory, or trigger a denial of service by blocking Bluetooth operations."], "name": "CVE-2026-68389", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:04:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68389\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68389\nhttps://git.kernel.org/stable/c/069258d5111eed9ac9586bee42d03d38e2975715\nhttps://git.kernel.org/stable/c/2363a757694752426fc47f3eadde15cf5f791fa5\nhttps://git.kernel.org/stable/c/5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a\nhttps://git.kernel.org/stable/c/bf587a10c33e5571a299742e45bc18960b9912e7\nhttps://git.kernel.org/stable/c/cefb44c367b2b52e50f97bc8526d39df9bcf5e60"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[06d3fdfcdf5cefb06f2024b9d3dad356779399cf,5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[06d3fdfcdf5cefb06f2024b9d3dad356779399cf,069258d5111eed9ac9586bee42d03d38e2975715)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[06d3fdfcdf5cefb06f2024b9d3dad356779399cf,cefb44c367b2b52e50f97bc8526d39df9bcf5e60)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[06d3fdfcdf5cefb06f2024b9d3dad356779399cf,2363a757694752426fc47f3eadde15cf5f791fa5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[06d3fdfcdf5cefb06f2024b9d3dad356779399cf,bf587a10c33e5571a299742e45bc18960b9912e7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T16:30:05.108943+00:00", "updated": "2026-08-14T01:15:17.091844+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}