CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections

CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: extend conn_hash lookup critical sections

Using RCU-protected pointers outside the critical sections without
refcount is incorrect and may result to UAF.

Extend critical section to cover both hci_conn_hash lookup and use of
the returned conn.

Add surrounding rcu_read_lock() also when return value is not used, in
preparation for RCU lockdep requirement to hci_lookup_le_connect().

This avoids concurrent deletion of the conn before we are done
dereferencing it.

Also, make sure to hold hdev->lock when accessing hdev->accept_list.

The Linux kernel CVE team has assigned CVE-2026-68393 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit 6d0417e4e1cf66fd917f06f0454958362714ef7d and fixed in 6.18.42 with commit 83b7e67698d0b93f685875ce82c8d335436834f7
	Issue introduced in 6.15 with commit 6d0417e4e1cf66fd917f06f0454958362714ef7d and fixed in 7.1.6 with commit 38326774df6198df0cc2744cc73bf77cb741c538
	Issue introduced in 6.15 with commit 6d0417e4e1cf66fd917f06f0454958362714ef7d and fixed in 7.2-rc4 with commit d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d
	Issue introduced in 6.12.28 with commit eb8b860e87b296bd1874c79a668081efd00f9754
	Issue introduced in 6.14.6 with commit 94bf6380e936339a700c0b3171a49baf512aa70b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68393
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/hci_sync.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/83b7e67698d0b93f685875ce82c8d335436834f7
	https://git.kernel.org/stable/c/38326774df6198df0cc2744cc73bf77cb741c538
	https://git.kernel.org/stable/c/d5efd6e4b8b0634af6843178fe1a7dd2b2178a3d