CVE-2026-68390

This CVE addresses a race condition in the Linux kernel's Bluetooth subsystem where hci_conn_params_lookup accesses the hci_conn_params data structure without holding the required hdev->lock. The fix explicitly mandates that callers acquire hdev->lock before invoking this function — a contract that was either missing or implicitly satisfied before the hci_sync refactoring. The critical insight here is that this vulnerability is almost certainly older than the CVE filing suggests. The hci_sync context represents a recent architectural refactoring that shifted lock acquisition from callee-handled to caller-dependent. Previously, the lock was likely held implicitly as a side effect of coarser-grained operations that happened to cover this access path. The refactoring didn't create the race so much as expose a latent one that was masked by coincidental serialization. This is the signature pattern of large-scale kernel refactoring: architectural changes that make implicit safety properties explicit, thereby revealing gaps that were always present but never audited. The asymmetry in the fix is notable. Lookups are explicitly protected by the patch, but the fact that modification paths apparently don't require the same treatment suggests either a genuine difference in concurrency characteristics or an incomplete audit. Given that hci_conn_params lives at the intersection of connection establishment, parameter negotiation, and teardown, the attack surface extends beyond generic privilege escalation to include Bluetooth connection state manipulation — a meaningfully different threat profile. EPSS data (0.00218) indicates limited practical exploitation activity, which is consistent with the timing constraints inherent to kernel race conditions. However, the EPSS figure measures current activity against an observed population, not forward-looking risk. As security researchers apply this CVE as a template to audit other hci_sync functions, additional similar findings are likely to emerge. The disclosed-but-unfixed surface grows with each analogous CVE. Practical guidance: verify that any custom or out-of-tree Bluetooth code calling hci_conn_params_lookup now acquires hdev->lock beforehand. Audit other hci_sync functions in your kernel version for similar access patterns to hci_conn_params. Treat this CVE as evidence of a pattern rather than an isolated instance — the hci_sync transition likely exposed a family of race conditions that will surface over the next 12-18 months as auditing continues.

Reviewed through automated stages and approved by a human before publication.