CVE-2026-68389
Bluetooth: hci_qca: Clear memdump state on invalid dump size
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump state on invalid dump size qca_controller_memdump() allocates qca->qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size. If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca->qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca->qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump. Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails. A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path.
INFO
Published Date :
Aug. 10, 2026, 1:20 p.m.
Last Modified :
Aug. 10, 2026, 1:20 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-68389
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Apply the Linux kernel patch for Bluetooth.
- Clear memdump state on invalid dump size.
- Ensure proper cleanup in error paths.
- Update the system to the latest kernel version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68389.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68389 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68389
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68389 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68389 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '06d3fdfcdf5cefb06f2024b9d3dad356779399cf', 'lessThan': '5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a', 'versionType': 'git'}, {'status': 'affected', 'version': '06d3fdfcdf5cefb06f2024b9d3dad356779399cf', 'lessThan': '069258d5111eed9ac9586bee42d03d38e2975715', 'versionType': 'git'}, {'status': 'affected', 'version': '06d3fdfcdf5cefb06f2024b9d3dad356779399cf', 'lessThan': 'cefb44c367b2b52e50f97bc8526d39df9bcf5e60', 'versionType': 'git'}, {'status': 'affected', 'version': '06d3fdfcdf5cefb06f2024b9d3dad356779399cf', 'lessThan': '2363a757694752426fc47f3eadde15cf5f791fa5', 'versionType': 'git'}, {'status': 'affected', 'version': '06d3fdfcdf5cefb06f2024b9d3dad356779399cf', 'lessThan': 'bf587a10c33e5571a299742e45bc18960b9912e7', 'versionType': 'git'}], 'programFiles': ['drivers/bluetooth/hci_qca.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.6'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.6', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/bluetooth/hci_qca.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Clear memdump state on invalid dump size qca_controller_memdump() allocates qca->qca_memdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active, and reads the advertised dump size. If the controller reports a zero dump size, the error path frees the local qca_memdump object and returns without clearing qca->qca_memdump or undoing the collection state. A later memdump work item initializes its local pointer from qca->qca_memdump and skips allocation when that pointer is non-NULL, so it can operate on freed memory. The stale collection and IBS-disabled flags can also leave waiters or later transmit handling blocked behind an aborted dump. Clear the saved pointer and memdump state before returning from the invalid-size path, matching the cleanup used when hci_devcd_init() fails. A static analysis checker reported the stale memdump state, and manual source review confirmed the invalid-size failure path. Added Reference https://git.kernel.org/stable/c/069258d5111eed9ac9586bee42d03d38e2975715 Added Reference https://git.kernel.org/stable/c/2363a757694752426fc47f3eadde15cf5f791fa5 Added Reference https://git.kernel.org/stable/c/5a3945e8dea6c9a8ec9e981169ac9487e1d6ad6a Added Reference https://git.kernel.org/stable/c/bf587a10c33e5571a299742e45bc18960b9912e7 Added Reference https://git.kernel.org/stable/c/cefb44c367b2b52e50f97bc8526d39df9bcf5e60